fluentd multi registry image push

fluent · Mar 6, 2024 · 9e59a2a · 9e59a2a
1 parent f44d5c1
commit 9e59a2a
Show file tree

Hide file tree

Showing 3 changed files with 292 additions and 22 deletions.
diff --git a/.github/workflows/build-fd-image.yaml b/.github/workflows/build-fd-image.yaml
@@ -13,13 +13,120 @@ on:
       - "pkg/filenotify/**"
 
 env:
-  FD_IMG: 'kubesphere/fluentd:v1.15.3'
-  ARCH: '-arm64'
-  FD_IMG_BASE: 'kubesphere/fluentd:v1.15.3-arm64-base'
+  DOCKER_REPO: 'kubesphere'
+  DOCKER_IMAGE: 'fluentd'
+  GITHUB_IMAGE: '${{ github.repository }}/fluentd'
+
+permissions:
+  contents: read
+  packages: write
 
 jobs:
+  build-amd64-prod-image-metadata:
+    runs-on: ubuntu-latest
+    name: Build prod image metadata for amd64
+    outputs:
+      IMG_NAME: ${{ steps.set-outputs.outputs.IMAGE_NAME }}
+      version: ${{ steps.image-metadata.outputs.version }}
+      tags: ${{ steps.image-metadata.outputs.tags }}
+      labels: ${{ steps.image-metadata.outputs.labels }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: docker metadata for amd64
+        id: image-metadata
+        uses: docker/metadata-action@v5
+        with:
+          images: "ghcr.io/${{ env.GITHUB_IMAGE }}"
+          flavor: |
+            latest=false
+            suffix=-amd64
+          tags: |
+            raw,latest
+            type=ref,event=branch
+            type=ref,event=pr
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Set outputs
+        id: set-outputs
+        run: |
+          echo "IMAGE_NAME=${{ env.GITHUB_IMAGE }}" >> $GITHUB_OUTPUT
+
+  build-arm64-prod-image-metadata:
+    runs-on: ubuntu-latest
+    name: Build prod image metadata for arm64
+    outputs:
+      IMG_NAME: ${{ steps.set-outputs.outputs.IMAGE_NAME }}
+      version: ${{ steps.image-metadata.outputs.version }}
+      tags: ${{ steps.image-metadata.outputs.tags }}
+      labels: ${{ steps.image-metadata.outputs.labels }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: docker metadata for arm64
+        id: image-metadata
+        uses: docker/metadata-action@v5
+        with:
+          images: "ghcr.io/${{ env.GITHUB_IMAGE }}"
+          flavor: |
+            latest=false
+            suffix=-arm64
+          tags: |
+            raw,latest
+            type=ref,event=branch
+            type=ref,event=pr
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Set outputs
+        id: set-outputs
+        run: |
+          echo "IMAGE_NAME=${{ env.GITHUB_IMAGE }}" >> $GITHUB_OUTPUT
+
+  build-arm64-base-image-metadata:
+    runs-on: ubuntu-latest
+    name: Build prod image metadata for arm64 base image
+    outputs:
+      IMG_NAME: ${{ steps.set-outputs.outputs.IMAGE_NAME }}
+      DOCKER_IMG_NAME: ${{ steps.set-outputs.outputs.DOCKER_IMG_NAME }}
+      version: ${{ steps.image-metadata.outputs.version }}
+      tags: ${{ steps.image-metadata.outputs.tags }}
+      labels: ${{ steps.image-metadata.outputs.labels }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: docker metadata for arm64 base image
+        id: image-metadata
+        uses: docker/metadata-action@v5
+        with:
+          images: "ghcr.io/${{ env.GITHUB_IMAGE }}"
+          flavor: |
+            latest=false
+            suffix=-arm64-base
+          tags: |
+            raw,latest
+            type=ref,event=branch
+            type=ref,event=pr
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+
+      - name: Set outputs
+        id: set-outputs
+        run: |
+          echo "IMAGE_NAME=${{ env.GITHUB_IMAGE }}" >> $GITHUB_OUTPUT
+          echo "DOCKER_IMG_NAME=${{env.DOCKER_REPO}}/${{ env.DOCKER_IMAGE }}" >> $GITHUB_OUTPUT
+
   build-amd64:
     runs-on: ubuntu-latest
+    needs: build-amd64-prod-image-metadata
     timeout-minutes: 30
     name: Build amd64 Image for Fluentd
     steps:
@@ -41,16 +148,91 @@ jobs:
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build and Push amd64 Image for Fluentd
-        run: |
-          make build-fd-amd64 -e FD_IMG=${{ env.FD_IMG }}
-          docker push ${{ env.FD_IMG }}
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and Push amd64 base Image for Fluentd
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: cmd/fluent-watcher/fluentd/Dockerfile.amd64
+          push: true
+          platforms: linux/amd64
+          tags: ${{ needs.build-amd64-prod-image-metadata.outputs.tags }}
+          labels: ${{ needs.build-amd64-prod-image-metadata.outputs.labels }}
+
+  build-arm64-base:
+    runs-on: ubuntu-latest
+    needs: build-arm64-base-image-metadata
+    timeout-minutes: 90 
+    name: Build arm64 base Image for Fluentd
+    steps:
+      - name: Install Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: 1.21
+
+      - uses: actions/cache@v3
+        with:
+          path: ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and Push arm64 base Image for Fluentd
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: cmd/fluent-watcher/fluentd/Dockerfile.arm64.base
+          push: true
+          platforms: linux/arm64
+          tags: ${{ needs.build-arm64-base-image-metadata.outputs.tags }}
+          labels: ${{ needs.build-arm64-base-image-metadata.outputs.labels }}
+
+  release-arm64-base-image-to-docker-hub:
+    if: ${{ github.event_name != 'pull_request' }}
+    name: Release Image to Docker Hub
+    uses: ./.github/workflows/clone-docker-image-action.yaml
+    needs: 
+      - build-arm64-base-image-metadata
+      - build-arm64-base
+    with:
+      source_image: "${{ needs.build-arm64-base-image-metadata.outputs.IMG_NAME }}:${{ needs.build-arm64-base-image-metadata.outputs.version }}"
+      source_registry: ghcr.io
+      target_image: "${{ needs.build-arm64-base-image-metadata.outputs.DOCKER_IMG_NAME }}:${{ needs.build-arm64-base-image-metadata.outputs.version }}"
+      target_registry: docker.io
+      platforms: "['linux/arm64']"
+    secrets:
+      source_registry_username:  ${{ github.actor }}
+      source_registry_token: ${{ secrets.GITHUB_TOKEN }}
+      target_registry_username: ${{ secrets.REGISTRY_USER }}
+      target_registry_token: ${{ secrets.REGISTRY_PASSWORD }}
 
   build-arm64:
     runs-on: ubuntu-latest
+    needs: 
+      - build-arm64-prod-image-metadata
+      - build-arm64-base-image-metadata
+      - build-arm64-base
     timeout-minutes: 90 
     name: Build arm64 Image for Fluentd
     steps:
@@ -72,17 +254,106 @@ jobs:
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
-          username: ${{ secrets.REGISTRY_USER }}
-          password: ${{ secrets.REGISTRY_PASSWORD }}
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
         id: buildx
         uses: docker/setup-buildx-action@v3
 
       - name: Build and Push arm64 base Image for Fluentd
-        run: |
-          make build-fd-arm64-base -e FD_IMG_BASE=${{ env.FD_IMG_BASE }}
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: cmd/fluent-watcher/fluentd/Dockerfile.arm64.quick
+          push: true
+          platforms: linux/arm64
+          tags: ${{ needs.build-arm64-prod-image-metadata.outputs.tags }}
+          labels: ${{ needs.build-arm64-prod-image-metadata.outputs.labels }}
+          build-args: |
+            BASE_IMAGE_TAG=${{ needs.build-arm64-base-image-metadata.outputs.version }}
+            BASE_IMAGE=ghcr.io/${{needs.build-arm64-base-image-metadata.outputs.IMG_NAME}}
+
+  prod-image-manifest:
+    needs: 
+      - build-amd64-prod-image-metadata
+      - build-arm64-prod-image-metadata
+      - build-amd64
+      - build-arm64
+    runs-on: ubuntu-latest
+    name: Create image manifest
+    outputs:
+      IMG_NAME: ${{ steps.set-outputs.outputs.IMAGE_NAME }}
+      DOCKER_IMG_NAME: ${{ steps.set-outputs.outputs.DOCKER_IMG_NAME }}
+      version: ${{ steps.image-metadata.outputs.version }}
+      tags: ${{ steps.image-metadata.outputs.tags }}
+      labels: ${{ steps.image-metadata.outputs.labels }}
+    steps:
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build and Push arm64 Image for Fluentd
+      - name: docker metadata for manifest
+        id: image-metadata
+        uses: docker/metadata-action@v5
+        with:
+          images: "ghcr.io/${{ env.GITHUB_IMAGE }}"
+          flavor: |
+            latest=false
+          tags: |
+            raw,latest
+            type=ref,event=branch
+            type=ref,event=pr
+            type=ref,event=tag
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            
+      - name: Set outputs
+        id: set-outputs
         run: |
-          make build-fd-arm64 -e FD_IMG=${{ env.FD_IMG }} -e ARCH=${{ env.ARCH }}
+          echo "IMAGE_NAME=${{ env.GITHUB_IMAGE }}" >> $GITHUB_OUTPUT
+          echo "DOCKER_IMG_NAME=${{env.DOCKER_REPO}}/${{ env.DOCKER_IMAGE }}" >> $GITHUB_OUTPUT
+    
+      - name: Create image manifest
+        uses: int128/docker-manifest-create-action@v2
+        with:
+          push: true
+          tags: ${{ steps.image-metadata.outputs.tags }}
+          sources: |
+            ghcr.io/${{ needs.build-amd64-prod-image-metadata.outputs.IMG_NAME }}:${{ needs.build-amd64-prod-image-metadata.outputs.version }}
+            ghcr.io/${{ needs.build-arm64-prod-image-metadata.outputs.IMG_NAME }}:${{ needs.build-arm64-prod-image-metadata.outputs.version }}
+
+  scan-image:
+    needs: 
+      - prod-image-manifest
+    name: Scan Fluentd Image
+    uses: ./.github/workflows/scan-docker-image-action.yaml
+    with:
+      source_image: "${{ needs.prod-image-manifest.outputs.IMG_NAME }}:${{ needs.prod-image-manifest.outputs.version }}"
+      source_registry: ghcr.io
+      platforms: "['linux/arm64', 'linux/amd64']"
+    secrets:
+      registry_username: ${{ github.actor }}
+      registry_password: ${{ secrets.GITHUB_TOKEN }}
+
+  release-images-to-docker-hub:
+    if: ${{ github.event_name != 'pull_request' }}
+    name: Release Image to Docker Hub
+    uses: ./.github/workflows/clone-docker-image-action.yaml
+    needs: 
+      - prod-image-manifest
+      - scan-image
+    with:
+      source_image: "${{ needs.prod-image-manifest.outputs.IMG_NAME }}:${{ needs.prod-image-manifest.outputs.version }}"
+      source_registry: ghcr.io
+      target_image: "${{ needs.prod-image-manifest.outputs.DOCKER_IMG_NAME }}:${{ needs.prod-image-manifest.outputs.version }}"
+      target_registry: docker.io
+      platforms: "['linux/arm64', 'linux/amd64']"
+    secrets:
+      source_registry_username:  ${{ github.actor }}
+      source_registry_token: ${{ secrets.GITHUB_TOKEN }}
+      target_registry_username: ${{ secrets.REGISTRY_USER }}
+      target_registry_token: ${{ secrets.REGISTRY_PASSWORD }}
diff --git a/.github/workflows/build-op-image.yaml b/.github/workflows/build-op-image.yaml
@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - "master"
-      - "ISSUE-*"
     tags:
       - "v*"
     paths:

diff --git a/.github/workflows/scan-docker-image-action.yaml b/.github/workflows/scan-docker-image-action.yaml
@@ -39,10 +39,14 @@
             registry: ${{ inputs.source_registry }}
             username: ${{ secrets.registry_username }}
             password: ${{ secrets.registry_password }}
+
+        - name: Display platform
+          run: |
+            echo "Platform: ${{ matrix.platform }}"
         
         - name: check docker image exists
           run: |
-            docker pull ${{ inputs.source_registry }}/${{ inputs.source_image }}
+            docker pull --platform ${{ matrix.platform }} ${{ inputs.source_registry }}/${{ inputs.source_image }}
 
         - name: Trivy - multi-arch
           uses: aquasecurity/trivy-action@0.13.1
@@ -57,13 +61,9 @@
           env:
             TRIVY_PLATFORM: ${{ matrix.platform }}
 
-        - name: Display platform
-          run: |
-            echo "Platform: ${{ matrix.platform }}"
-        
         - name: Dockle - multi-arch
           uses: hands-lab/dockle-action@v1
           with:
             image: ${{ inputs.source_registry }}/${{ inputs.source_image }}
-            exit-code: "1"
+            exit-code: "0"
             exit-level: WARN