The release process is producing a local image and scanning it
with trivy before continuing the process.
As trivy is by default having its cache in the checked out folder
for the code, the git repository ends up having content, and
considered dirty by goreleaser.
This is a problem, as goreleaser does not want to release if the
git tree is dirty.
This fixes it by ignoring all changes in .cache folder.
Signed-off-by: Jean-Philippe Evrard <open-source@a.spamming.party>
GoReleaser now builds the multi-arch images,
publishes SBOM/provenance metadata, signs image digests, and attaches
the generated combined Kubernetes manifest to tagged GitHub releases.
This is to have goReleaser as a single point of work for release
automation. With this, so tags and main commits follow one consistent
image pipeline.
We keep the CI and developer image builds intentionally local.
PR, periodic, main, and tag scan jobs build only `kured:dev` and scan that
local image with Trivy, which avoids pushing disposable images and keeps
the tested image identical to the one used by kind-based e2e tests.
Simplify the Makefile around the remaining artifact boundaries: `build` for a
local GoReleaser binary build, `dev-image` for local Docker/e2e/scan use, and
`release` for the GoReleaser publish path. Remove the old manual manifest
target because the release manifest is now generated during the tagged release
flow.
To avoid a mess with all the configuration files, I move everything into
a `.config` folder, for the tools supporting it.
This also meant updating golangci-lint to a valid v2 config, and simplify
the Dockerfile to the layout expected by GoReleaser `dockers_v2`
using `TARGETPLATFORM`.
Handle Prometheus client initialization errors explicitly so the stricter
errcheck configuration keeps the existing fail-closed reboot-blocking behavior,
to fix the golangci-lint issue that appeared.
Signed-off-by: Jean-Philippe Evrard <open-source@a.spamming.party>
* Move to stable kind cluster filenames
Without this, we have to rename files at every version.
This is really unnecessary, we should only change the files
and be done with it.
This is a problem, as if we move to programmatic test running,
the tests would need to be mutatated at every k8s version.
With this model, we know that only the kind-cluster files
need to be modified for the tests to ba automatically
adapted.
Signed-off-by: Jean-Philippe Evrard <open-source@a.spamming.party>
* Create e2e from go tests interface
Without this, e2e tests need tons of manual work to
test locally, and the results are not easily exposed.
People are less likely to use the e2e tests if they
are tough to use outside the CI.
This commit makes it easier to run tests locally,
and ensures the CI is closer to the Makefile.
At the same time, this removes debt in the github
worfklows: By switching to newer versions of kind,
we can remove the very old workaround for the
failed to attach pid 1.
Signed-off-by: Jean-Philippe Evrard <open-source@a.spamming.party>
* Add node stays as cordonned test
Without this, impossible to prove that the node stays as cordonned
after a reboot by kured.
This refactor also adds the test in the CI, and makes sure the
CI is a bit simpler, by using matrix more extensively.
Signed-off-by: Jean-Philippe Evrard <open-source@a.spamming.party>
* Use hack dir instead of .tmp
This is more idiomatic.
Signed-off-by: Jean-Philippe Evrard <open-source@a.spamming.party>
---------
Signed-off-by: Jean-Philippe Evrard <open-source@a.spamming.party>
Jean-Philippe Evrard
Dharsan Baskar
Jean-Philippe Evrard
Christian Kotzbauer
Adam Harrison