Skip to content

Commit 89eff10

Browse files
author
Marcelo
committed
First commit
0 parents  commit 89eff10

File tree

90 files changed

+23131
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

90 files changed

+23131
-0
lines changed

‎.github/renovate.json‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
{
2+
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
3+
"extends": [
4+
"config:base",
5+
"docker:enableMajor",
6+
":dependencyDashboard",
7+
":semanticCommits",
8+
":automergeDigest",
9+
":automergeBranch"
10+
],
11+
"schedule": ["before 6am on monday"],
12+
"timezone": "UTC",
13+
"labels": ["dependencies"],
14+
"assigneesFromCodeOwners": true,
15+
"reviewersFromCodeOwners": true,
16+
"golang": {
17+
"enabled": true
18+
},
19+
"docker": {
20+
"enabled": true
21+
},
22+
"github-actions": {
23+
"enabled": true
24+
},
25+
"packageRules": [
26+
{
27+
"matchDatasources": ["go"],
28+
"groupName": "go dependencies",
29+
"commitMessageTopic": "Go dependencies"
30+
},
31+
{
32+
"matchDatasources": ["docker"],
33+
"groupName": "docker images",
34+
"commitMessageTopic": "Docker images"
35+
},
36+
{
37+
"matchDatasources": ["github-actions"],
38+
"groupName": "GitHub Actions",
39+
"commitMessageTopic": "GitHub Actions"
40+
},
41+
{
42+
"matchPackagePatterns": ["^k8s.io/", "^sigs.k8s.io/"],
43+
"groupName": "kubernetes dependencies",
44+
"commitMessageTopic": "Kubernetes dependencies"
45+
},
46+
{
47+
"matchPackageNames": ["go"],
48+
"enabled": false
49+
}
50+
],
51+
"vulnerabilityAlerts": {
52+
"enabled": true
53+
},
54+
"osvVulnerabilityAlerts": true
55+
}

‎.github/workflows/ci.yml‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [ main, develop ]
6+
pull_request:
7+
branches: [ main, develop ]
8+
9+
env:
10+
GO_VERSION: '1.21'
11+
12+
jobs:
13+
test:
14+
name: Test
15+
runs-on: ubuntu-latest
16+
17+
steps:
18+
- name: Check out code
19+
uses: actions/checkout@v4
20+
21+
- name: Set up Go
22+
uses: actions/setup-go@v4
23+
with:
24+
go-version: ${{ env.GO_VERSION }}
25+
26+
- name: Cache Go modules
27+
uses: actions/cache@v3
28+
with:
29+
path: |
30+
~/.cache/go-build
31+
~/go/pkg/mod
32+
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
33+
restore-keys: |
34+
${{ runner.os }}-go-
35+
36+
- name: Download dependencies
37+
run: make mod-tidy
38+
39+
- name: Run unit tests
40+
run: make test
41+
42+
- name: Upload coverage to Codecov
43+
uses: codecov/codecov-action@v3
44+
with:
45+
file: ./coverage.out
46+
flags: unittests
47+
name: codecov-umbrella
48+
49+
nftables-tests:
50+
name: NFTables Tests
51+
runs-on: ubuntu-latest
52+
53+
steps:
54+
- name: Check out code
55+
uses: actions/checkout@v4
56+
57+
- name: Set up Go
58+
uses: actions/setup-go@v4
59+
with:
60+
go-version: ${{ env.GO_VERSION }}
61+
62+
- name: Install NFTables
63+
run: |
64+
sudo apt-get update
65+
sudo apt-get install -y nftables
66+
sudo modprobe nf_tables
67+
68+
- name: Download dependencies
69+
run: make mod-tidy
70+
71+
- name: Run NFTables unit tests
72+
run: make test-verbose ARGS="./pkg/nftables -short"
73+
74+
- name: Run NFTables integration tests
75+
run: sudo make test-integration
76+
77+
controller-tests:
78+
name: Controller Tests
79+
runs-on: ubuntu-latest
80+
81+
steps:
82+
- name: Check out code
83+
uses: actions/checkout@v4
84+
85+
- name: Set up Go
86+
uses: actions/setup-go@v4
87+
with:
88+
go-version: ${{ env.GO_VERSION }}
89+
90+
- name: Download dependencies
91+
run: make mod-tidy
92+
93+
- name: Run controller tests
94+
run: make test-controller
95+
96+
- name: Run datastore tests
97+
run: make test-verbose ARGS="./pkg/datastore"
98+
99+
- name: Run utils tests
100+
run: make test-verbose ARGS="./pkg/utils"
101+
102+
lint:
103+
name: Lint
104+
runs-on: ubuntu-latest
105+
106+
steps:
107+
- name: Check out code
108+
uses: actions/checkout@v4
109+
110+
- name: Set up Go
111+
uses: actions/setup-go@v4
112+
with:
113+
go-version: ${{ env.GO_VERSION }}
114+
115+
- name: Install golangci-lint
116+
run: |
117+
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.55.2
118+
echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
119+
120+
- name: Run golangci-lint
121+
run: make lint
122+
123+
security:
124+
name: Security Scan
125+
runs-on: ubuntu-latest
126+
127+
steps:
128+
- name: Check out code
129+
uses: actions/checkout@v4
130+
131+
- name: Set up Go
132+
uses: actions/setup-go@v4
133+
with:
134+
go-version: ${{ env.GO_VERSION }}
135+
136+
- name: Install gosec
137+
run: go install github.com/securecodewarrior/gosec/v2/cmd/gosec@latest
138+
139+
- name: Run security scan
140+
run: make security-scan
141+
142+
build:
143+
name: Build
144+
runs-on: ubuntu-latest
145+
needs: [test, nftables-tests, controller-tests, lint, security]
146+
147+
steps:
148+
- name: Check out code
149+
uses: actions/checkout@v4
150+
151+
- name: Set up Go
152+
uses: actions/setup-go@v4
153+
with:
154+
go-version: ${{ env.GO_VERSION }}
155+
156+
- name: Build binary
157+
run: make build
158+
159+
- name: Upload binary artifact
160+
uses: actions/upload-artifact@v3
161+
with:
162+
name: multi-networkpolicy-nftables-linux-amd64
163+
path: bin/multi-networkpolicy-nftables
164+
retention-days: 30

‎.github/workflows/dependencies.yml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
name: Dependency Updates
2+
3+
on:
4+
schedule:
5+
# Run weekly on Mondays at 9 AM UTC
6+
- cron: '0 9 * * 1'
7+
workflow_dispatch:
8+
9+
jobs:
10+
update-dependencies:
11+
name: Update Go Dependencies
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Check out code
16+
uses: actions/checkout@v4
17+
with:
18+
token: ${{ secrets.GITHUB_TOKEN }}
19+
20+
- name: Set up Go
21+
uses: actions/setup-go@v4
22+
with:
23+
go-version: '1.21'
24+
25+
- name: Update Go dependencies
26+
run: |
27+
go get -u all
28+
go mod tidy
29+
go mod verify
30+
31+
- name: Run tests with updated dependencies
32+
run: go test ./...
33+
34+
- name: Check for vulnerabilities
35+
run: |
36+
go install golang.org/x/vuln/cmd/govulncheck@latest
37+
govulncheck ./...
38+
39+
- name: Create Pull Request
40+
uses: peter-evans/create-pull-request@v5
41+
with:
42+
token: ${{ secrets.GITHUB_TOKEN }}
43+
commit-message: 'chore: update Go dependencies'
44+
title: 'chore: update Go dependencies'
45+
body: |
46+
This PR updates Go dependencies to their latest versions.
47+
48+
## Changes
49+
- Updated all Go dependencies to latest versions
50+
- Ran `go mod tidy` to clean up module file
51+
- Verified all tests pass with updated dependencies
52+
- Checked for security vulnerabilities with govulncheck
53+
54+
## Testing
55+
- [x] All tests pass
56+
- [x] No security vulnerabilities detected
57+
- [x] Module file is clean and verified
58+
59+
This PR was automatically created by the dependency update workflow.
60+
branch: chore/update-dependencies
61+
delete-branch: true
62+
63+
update-github-actions:
64+
name: Update GitHub Actions
65+
runs-on: ubuntu-latest
66+
67+
steps:
68+
- name: Check out code
69+
uses: actions/checkout@v4
70+
with:
71+
token: ${{ secrets.GITHUB_TOKEN }}
72+
73+
- name: Update GitHub Actions versions
74+
uses: renovatebot/github-action@v39.2.3
75+
with:
76+
configurationFile: .github/renovate.json
77+
token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/docker.yml‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
name: Docker Build
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
tags: [ 'v*' ]
7+
pull_request:
8+
branches: [ main ]
9+
10+
env:
11+
REGISTRY: ghcr.io
12+
IMAGE_NAME: ${{ github.repository }}
13+
14+
jobs:
15+
build-and-push:
16+
name: Build and Push Docker Image
17+
runs-on: ubuntu-latest
18+
permissions:
19+
contents: read
20+
packages: write
21+
22+
steps:
23+
- name: Check out code
24+
uses: actions/checkout@v4
25+
26+
- name: Set up Docker Buildx
27+
uses: docker/setup-buildx-action@v3
28+
29+
- name: Log in to Container Registry
30+
if: github.event_name != 'pull_request'
31+
uses: docker/login-action@v3
32+
with:
33+
registry: ${{ env.REGISTRY }}
34+
username: ${{ github.actor }}
35+
password: ${{ secrets.GITHUB_TOKEN }}
36+
37+
- name: Extract metadata
38+
id: meta
39+
uses: docker/metadata-action@v5
40+
with:
41+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
42+
tags: |
43+
type=ref,event=branch
44+
type=ref,event=pr
45+
type=semver,pattern={{version}}
46+
type=semver,pattern={{major}}.{{minor}}
47+
type=semver,pattern={{major}}
48+
type=sha,prefix={{branch}}-
49+
50+
- name: Build and push Docker image
51+
uses: docker/build-push-action@v5
52+
with:
53+
context: .
54+
platforms: linux/amd64,linux/arm64
55+
push: ${{ github.event_name != 'pull_request' }}
56+
tags: ${{ steps.meta.outputs.tags }}
57+
labels: ${{ steps.meta.outputs.labels }}
58+
cache-from: type=gha
59+
cache-to: type=gha,mode=max
60+
61+
- name: Run Trivy vulnerability scanner
62+
if: github.event_name != 'pull_request'
63+
uses: aquasecurity/trivy-action@master
64+
with:
65+
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.version }}
66+
format: 'sarif'
67+
output: 'trivy-results.sarif'
68+
69+
- name: Upload Trivy scan results
70+
if: github.event_name != 'pull_request'
71+
uses: github/codeql-action/upload-sarif@v2
72+
with:
73+
sarif_file: 'trivy-results.sarif'

0 commit comments

Comments
 (0)