Skip to content

Commit 33d0b8e

Browse files
TomerFiTomerFi
committed
added ubi-flavoured image for the operator and the proxy runner
Signed-off-by: Tomer Figenblat <[email protected]>
1 parent 2642816 commit 33d0b8e

File tree

3 files changed

+148
-1
lines changed

3 files changed

+148
-1
lines changed

‎.github/workflows/image-build-and-publish.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,21 @@ jobs:
213213
- name: Setup ko
214214
uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9
215215

216+
- name: Set up Docker Buildx
217+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
218+
219+
- name: Extract UBI metadata
220+
id: ubi-meta
221+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
222+
with:
223+
images: ${{ env.BASE_REPO }}
224+
tags: |
225+
type=raw,value=${{ steps.version-string.outputs.tag }}-ubi
226+
labels: |
227+
name=toolhive-operator
228+
vendor=Stacklok
229+
maintainer=Stacklok
230+
216231
- name: Install Cosign
217232
uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
218233

@@ -234,13 +249,29 @@ jobs:
234249
KO_DOCKER_REPO=$BASE_REPO ko build --platform=linux/amd64,linux/arm64 --bare $TAGS ./cmd/thv-operator \
235250
--image-label=org.opencontainers.image.source=https://github.com/stacklok/toolhive,org.opencontainers.image.title="toolhive-operator",org.opencontainers.image.vendor=Stacklok
236251
252+
- name: Build and Push UBI Image to GHCR
253+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
254+
with:
255+
file: containers/operator/Dockerfile
256+
platforms: linux/amd64,linux/arm64
257+
push: true
258+
tags: ${{ steps.ubi-meta.outputs.tags }}
259+
build-args: |
260+
CODEDIR=cmd/thv-operator
261+
VERSION=${{ steps.version-string.outputs.tag }}-ubi
262+
COMMIT=${{ github.sha }}
263+
BUILD_DATE=${{ github.event.head_commit.timestamp }}
264+
labels: ${{ steps.ubi-meta.outputs.labels }}
265+
237266
- name: Sign Image with Cosign
238267
# This step uses the identity token to provision an ephemeral certificate
239268
# against the sigstore community Fulcio instance.
240269
run: |
241270
TAG=$(echo "${{ steps.version-string.outputs.tag }}" | sed 's/+/_/g')
271+
UBI_TAG=$(echo "${{ steps.version-string.outputs.tag }}-ubi" | sed 's/+/_/g')
242272
# Sign the ko image
243273
cosign sign -y $BASE_REPO:$TAG
274+
cosign sign -y $BASE_REPO:$UBI_TAG
244275
245276
# Sign the latest tag if building from a tag
246277
if [[ "${{ github.ref }}" == refs/tags/* ]]; then
@@ -293,6 +324,21 @@ jobs:
293324
- name: Setup ko
294325
uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9
295326

327+
- name: Set up Docker Buildx
328+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
329+
330+
- name: Extract UBI metadata
331+
id: ubi-meta
332+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
333+
with:
334+
images: ${{ env.BASE_REPO }}
335+
tags: |
336+
type=raw,value=${{ steps.version-string.outputs.tag }}-ubi
337+
labels: |
338+
name=toolhive-proxyrunner
339+
vendor=Stacklok
340+
maintainer=Stacklok
341+
296342
- name: Install Cosign
297343
uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
298344

@@ -314,13 +360,29 @@ jobs:
314360
KO_DOCKER_REPO=$BASE_REPO ko build --platform=linux/amd64,linux/arm64 --bare $TAGS ./cmd/thv-proxyrunner \
315361
--image-label=org.opencontainers.image.source=https://github.com/stacklok/toolhive,org.opencontainers.image.title="toolhive-proxyrunner",org.opencontainers.image.vendor=Stacklok
316362
363+
- name: Build and Push UBI Image to GHCR
364+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
365+
with:
366+
file: containers/operator/Dockerfile
367+
platforms: linux/amd64,linux/arm64
368+
push: true
369+
tags: ${{ steps.ubi-meta.outputs.tags }}
370+
build-args: |
371+
CODEDIR=cmd/thv-proxyrunner
372+
VERSION=${{ steps.version-string.outputs.tag }}
373+
COMMIT=${{ github.sha }}
374+
BUILD_DATE=${{ github.event.head_commit.timestamp }}
375+
labels: ${{ steps.ubi-meta.outputs.labels }}
376+
317377
- name: Sign Image with Cosign
318378
# This step uses the identity token to provision an ephemeral certificate
319379
# against the sigstore community Fulcio instance.
320380
run: |
321381
TAG=$(echo "${{ steps.version-string.outputs.tag }}" | sed 's/+/_/g')
382+
UBI_TAG=$(echo "${{ steps.version-string.outputs.tag }}-ubi" | sed 's/+/_/g')
322383
# Sign the ko image
323384
cosign sign -y $BASE_REPO:$TAG
385+
cosign sign -y $BASE_REPO:$UBI_TAG
324386
325387
# Sign the latest tag if building from a tag
326388
if [[ "${{ github.ref }}" == refs/tags/* ]]; then

‎cmd/thv-operator/Taskfile.yml‎

Lines changed: 44 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ vars:
2525
fi
2626
KEYCLOAK_VERSION: '26.3.2'
2727

28-
2928
tasks:
3029
kind-setup:
3130
desc: Setup a local Kind cluster
@@ -342,3 +341,47 @@ tasks:
342341
- echo "Keycloak will be available at http://localhost:8080"
343342
- echo "Use 'task keycloak:get-admin-creds' to get login credentials"
344343
- kubectl port-forward service/keycloak-dev-service -n keycloak 8080:8080 --kubeconfig kconfig.yaml
344+
345+
build-operator-image-ubi:
346+
desc: Build the operator image
347+
vars:
348+
COMMIT:
349+
sh: git rev-parse --short HEAD || echo "unknown"
350+
BUILD_DATE: '{{dateInZone "2006-01-02T15:04:05Z" (now) "UTC"}}'
351+
cmds:
352+
- >
353+
eval "{{.CONTAINER_RUNTIME}} build --load
354+
-t ghcr.io/stacklok/toolhive/operator:local-ubi
355+
--build-arg CODEDIR=cmd/thv-operator
356+
--build-arg VERSION=local-ubi
357+
--build-arg COMMIT={{.COMMIT}}
358+
--build-arg BUILD_DATE={{.BUILD_DATE}}
359+
--label name=\"toolhive-operator\"
360+
--label vendor=\"Stacklok\"
361+
--label maintainer=\"Stacklok\"
362+
--label org.opencontainers.image.source=\"https://github.com/stacklok/toolhive\"
363+
--label org.opencontainers.image.title=\"toolhive-operator\"
364+
--label org.opencontainers.image.vendor=\"Stacklok\"
365+
-f containers/operator/Dockerfile ."
366+
367+
build-proxyrunner-image-ubi:
368+
desc: Build the proxyrunner image
369+
vars:
370+
COMMIT:
371+
sh: git rev-parse --short HEAD || echo "unknown"
372+
BUILD_DATE: '{{dateInZone "2006-01-02T15:04:05Z" (now) "UTC"}}'
373+
cmds:
374+
- >
375+
eval "{{.CONTAINER_RUNTIME}} build --load
376+
-t ghcr.io/stacklok/toolhive/proxyrunner:local-ubi
377+
--build-arg CODEDIR=cmd/thv-proxyrunner
378+
--build-arg VERSION=local-ubi
379+
--build-arg COMMIT={{.COMMIT}}
380+
--build-arg BUILD_DATE={{.BUILD_DATE}}
381+
--label name=\"toolhive-proxyrunner\"
382+
--label vendor=\"Stacklok\"
383+
--label maintainer=\"Stacklok\"
384+
--label org.opencontainers.image.source=\"https://github.com/stacklok/toolhive\"
385+
--label org.opencontainers.image.title=\"toolhive-proxyrunner\"
386+
--label org.opencontainers.image.vendor=\"Stacklok\"
387+
-f containers/operator/Dockerfile ."

‎containers/operator/Dockerfile‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Build the binary
2+
FROM registry.access.redhat.com/ubi10/go-toolset:1.24 as builder
3+
4+
USER root
5+
6+
WORKDIR /workspace
7+
8+
# Copy the Go Modules manifests
9+
COPY go.mod go.mod
10+
COPY go.sum go.sum
11+
# cache deps before building and copying source so that we don't need to re-download as much
12+
# and so that source changes don't invalidate our downloaded layer
13+
RUN go mod download
14+
15+
ARG TARGETOS \
16+
TARGETARCH \
17+
CODEDIR \
18+
VERSION \
19+
COMMIT \
20+
BUILD_DATE
21+
22+
# Copy the entire Go module structure
23+
COPY . .
24+
25+
# Build
26+
RUN CGO_ENABLED=0 LDFLAGS="-s -w \
27+
-X github.com/stacklok/toolhive/pkg/versions.Version=${VERSION} \
28+
-X github.com/stacklok/toolhive/pkg/versions.Commit=${COMMIT} \
29+
-X github.com/stacklok/toolhive/pkg/versions.BuildDate=${BUILD_DATE} \
30+
-X github.com/stacklok/toolhive/pkg/versions.BuildType=release" \
31+
GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH:-amd64} \
32+
go build -o main ./${CODEDIR}/main.go
33+
34+
# Use micro base image to package the binary
35+
FROM registry.access.redhat.com/ubi10/ubi-micro:10.0
36+
37+
COPY --from=builder /workspace/main /
38+
COPY LICENSE /licenses/LICENSE
39+
40+
USER 1001
41+
42+
ENTRYPOINT ["/main"]

0 commit comments

Comments
 (0)