Skip to content

Commit d309f01

Browse files
openshift-merge-bot[bot]osmman
openshift-merge-bot[bot]
authored and
osmman
committed
Merge pull request #820 from securesign/migrate_trillian
Migrate trillian
2 parents 1ab8019 + e250155 commit d309f01

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+1066
-832
lines changed

‎.github/workflows/main.yml

+5-5
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
go-version: ${{ env.GO_VERSION }}
2929

3030
- name: Replace images
31-
run: make dev-images && cat internal/controller/constants/images.go
31+
run: make dev-images && cat internal/images/images.env
3232

3333
- name: Build operator container
3434
run: make docker-build docker-push
@@ -51,7 +51,7 @@ jobs:
5151
uses: actions/checkout@v4
5252

5353
- name: Replace images
54-
run: make dev-images && cat internal/controller/constants/images.go
54+
run: make dev-images && cat internal/images/images.env
5555

5656
- name: Build operator bundle
5757
run: make bundle bundle-build bundle-push
@@ -228,7 +228,7 @@ jobs:
228228
run: go install github.com/sigstore/cosign/v2/cmd/[email protected]
229229

230230
- name: Replace images
231-
run: make dev-images && cat internal/controller/constants/images.go
231+
run: make dev-images && cat internal/images/images.env
232232

233233
- name: Run tests
234234
run: make test-e2e
@@ -300,7 +300,7 @@ jobs:
300300
run: go install github.com/sigstore/cosign/v2/cmd/[email protected]
301301

302302
- name: Replace images
303-
run: make dev-images && cat internal/controller/constants/images.go
303+
run: make dev-images && cat internal/images/images.env
304304

305305
- name: Run tests
306306
env:
@@ -365,7 +365,7 @@ jobs:
365365
sudo echo "127.0.0.1 fulcio-server.local tuf.local rekor-server.local rekor-search-ui.local cli-server.local" | sudo tee -a /etc/hosts
366366
367367
- name: Replace images
368-
run: make dev-images && cat internal/controller/constants/images.go
368+
run: make dev-images && cat internal/images/images.env
369369

370370
- name: Run tests
371371
env:

‎Makefile

+12-9
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,11 @@ SHELL = /usr/bin/env bash -o pipefail
8585

8686
OPENSHIFT ?= true
8787

88+
CONFIG_DEFAULT=config/env/kubernetes
89+
ifeq ($(OPENSHIFT), true)
90+
CONFIG_DEFAULT=config/env/openshift
91+
endif
92+
8893
.PHONY: all
8994
all: build
9095

@@ -136,9 +141,9 @@ test-e2e:
136141
.PHONY: dev-images
137142
dev-images:
138143
@if [ "$(shell uname)" = "Darwin" ]; then \
139-
sed -E -i '' -f ci/dev-images.sed internal/controller/constants/images.go; \
144+
sed -E -i '' -f ci/dev-images.sed internal/images/images.env; \
140145
else \
141-
sed -E -i -f ci/dev-images.sed internal/controller/constants/images.go; \
146+
sed -E -i -f ci/dev-images.sed internal/images/images.env; \
142147
fi
143148

144149
.PHONY: lint
@@ -195,7 +200,7 @@ docker-buildx: ## Build and push docker image for the manager for cross-platform
195200
build-installer: manifests generate kustomize ## Generate a consolidated YAML with CRDs and deployment.
196201
mkdir -p dist
197202
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
198-
$(KUSTOMIZE) build config/default > dist/install.yaml
203+
$(KUSTOMIZE) build --load-restrictor LoadRestrictionsNone ${CONFIG_DEFAULT} > dist/install.yaml
199204

200205
##@ Deployment
201206

@@ -214,14 +219,12 @@ uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified
214219
.PHONY: deploy
215220
deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
216221
cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
217-
$(KUSTOMIZE) build config/default | $(KUBECTL) apply -f -
218-
@if [ "$(OPENSHIFT)" == "false" ]; then \
219-
$(KUBECTL) patch deploy -n openshift-rhtas-operator -p '{"spec": {"template": {"spec": {"containers": [{"name": "manager","env": [{"name": "OPENSHIFT","value":"false"}]}]}}}}' rhtas-operator-controller-manager; \
220-
fi
222+
$(KUSTOMIZE) build --load-restrictor LoadRestrictionsNone ${CONFIG_DEFAULT} | $(KUBECTL) apply -f -
223+
221224

222225
.PHONY: undeploy
223226
undeploy: kustomize ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
224-
$(KUSTOMIZE) build config/default | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -
227+
$(KUSTOMIZE) build --load-restrictor LoadRestrictionsNone ${CONFIG_DEFAULT} | $(KUBECTL) delete --ignore-not-found=$(ignore-not-found) -f -
225228

226229
##@ Dependencies
227230

@@ -298,7 +301,7 @@ endif
298301
bundle: manifests kustomize operator-sdk ## Generate bundle manifests and metadata, then validate generated files.
299302
$(OPERATOR_SDK) generate kustomize manifests -q
300303
cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG)
301-
$(KUSTOMIZE) build config/manifests | $(OPERATOR_SDK) generate bundle $(BUNDLE_GEN_FLAGS)
304+
$(KUSTOMIZE) build --load-restrictor LoadRestrictionsNone config/manifests | $(OPERATOR_SDK) generate bundle $(BUNDLE_GEN_FLAGS)
302305
$(OPERATOR_SDK) bundle validate ./bundle
303306

304307
.PHONY: bundle-build

‎bundle/manifests/rhtas-operator.clusterserviceversion.yaml

+62-1
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,7 @@ metadata:
297297
]
298298
capabilities: Seamless Upgrades
299299
containerImage: registry.redhat.io/rhtas/rhtas-rhel9-operator@sha256:52ba6cd82bc400a08c6f89811e8086126596a873b9b12619de8c5064a2d4faf7
300-
createdAt: "2024-11-07T12:56:22Z"
300+
createdAt: "2025-01-16T11:15:48Z"
301301
features.operators.openshift.io/cnf: "false"
302302
features.operators.openshift.io/cni: "false"
303303
features.operators.openshift.io/csi: "false"
@@ -892,6 +892,36 @@ spec:
892892
env:
893893
- name: OPENSHIFT
894894
value: "true"
895+
- name: RELATED_IMAGE_TRILLIAN_LOG_SIGNER
896+
value: registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:2d707d12e4f65e1a92b4de11465a5976d55e15ad6c9fefe994646ccd44c83840
897+
- name: RELATED_IMAGE_TRILLIAN_LOG_SERVER
898+
value: registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:7af78c7bc4df097ffeeef345f1d13289695f715221957579ee65daeef2fa3f5b
899+
- name: RELATED_IMAGE_TRILLIAN_DB
900+
value: registry.redhat.io/rhtas/trillian-database-rhel9@sha256:501612745e63e5504017079388bec191ffacf00ffdebde7be6ca5b8e4fd9d323
901+
- name: RELATED_IMAGE_TRILLIAN_NETCAT
902+
value: registry.redhat.io/openshift4/ose-tools-rhel8@sha256:486b4d2dd0d10c5ef0212714c94334e04fe8a3d36cf619881986201a50f123c7
903+
- name: RELATED_IMAGE_FULCIO_SERVER
904+
value: registry.redhat.io/rhtas/fulcio-rhel9@sha256:4b5765bbfd3dac5fa027d2fb3d672b6ebffbc573b9413ab4cb189c50fa6f9a09
905+
- name: RELATED_IMAGE_REKOR_REDIS
906+
value: registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:18820b1fbdbc2cc3e917822974910332d937b03cfe781628bd986fd6a5ee318e
907+
- name: RELATED_IMAGE_REKOR_SERVER
908+
value: registry.redhat.io/rhtas/rekor-server-rhel9@sha256:81e10e34f02b21bb8295e7b5c93797fc8c0e43a1a0d8304cca1b07415a3ed6f5
909+
- name: RELATED_IMAGE_REKOR_SEARCH_UI
910+
value: registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:3c93c15fc5c918a91b3da9f5bf2276e4d46d881b1031287e6ab28e6aeb23e019
911+
- name: RELATED_IMAGE_BACKFILL_REDIS
912+
value: registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:6aa3ca40e0f9e32a0a211a930b21ff009b83e46609bfa5bb328979e4799d13c7
913+
- name: RELATED_IMAGE_TUF
914+
value: registry.redhat.io/rhtas/tuffer-rhel9@sha256:79340be7918034c68a334a210ab872161827c99c2a1551a4fce8d5d27560a234
915+
- name: RELATED_IMAGE_CTLOG
916+
value: registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:31e7318a9b19ed04ef0f25949f1f1709d293b532316b27a06f83fa5174547b17
917+
- name: RELATED_IMAGE_HTTP_SERVER
918+
value: registry.access.redhat.com/ubi9/httpd-24@sha256:7874b82335a80269dcf99e5983c2330876f5fe8bdc33dc6aa4374958a2ffaaee
919+
- name: RELATED_IMAGE_SEGMENT_REPORTING
920+
value: registry.redhat.io/rhtas/segment-reporting-rhel9@sha256:1b87ff1ad02c476c08e06038a26af7abe61f177e491a9ff42d507550a8587ac8
921+
- name: RELATED_IMAGE_TIMESTAMP_AUTHORITY
922+
value: registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:fce0a22c8872309554236bab3457715dda0a83eb40dc6a9ecd3477b8023369d0
923+
- name: RELATED_IMAGE_CLIENT_SERVER
924+
value: registry.redhat.io/rhtas/client-server-rhel9@sha256:9537329d0166b8d41ffd5f5d79c052fc27abe426a20cba5733c84030013c4e29
895925
image: registry.redhat.io/rhtas/rhtas-rhel9-operator@sha256:52ba6cd82bc400a08c6f89811e8086126596a873b9b12619de8c5064a2d4faf7
896926
livenessProbe:
897927
httpGet:
@@ -998,4 +1028,35 @@ spec:
9981028
provider:
9991029
name: Red Hat
10001030
url: https://github.com/securesign/secure-sign-operator
1031+
relatedImages:
1032+
- image: registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:2d707d12e4f65e1a92b4de11465a5976d55e15ad6c9fefe994646ccd44c83840
1033+
name: trillian-log-signer
1034+
- image: registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:7af78c7bc4df097ffeeef345f1d13289695f715221957579ee65daeef2fa3f5b
1035+
name: trillian-log-server
1036+
- image: registry.redhat.io/rhtas/trillian-database-rhel9@sha256:501612745e63e5504017079388bec191ffacf00ffdebde7be6ca5b8e4fd9d323
1037+
name: trillian-db
1038+
- image: registry.redhat.io/openshift4/ose-tools-rhel8@sha256:486b4d2dd0d10c5ef0212714c94334e04fe8a3d36cf619881986201a50f123c7
1039+
name: trillian-netcat
1040+
- image: registry.redhat.io/rhtas/fulcio-rhel9@sha256:4b5765bbfd3dac5fa027d2fb3d672b6ebffbc573b9413ab4cb189c50fa6f9a09
1041+
name: fulcio-server
1042+
- image: registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:18820b1fbdbc2cc3e917822974910332d937b03cfe781628bd986fd6a5ee318e
1043+
name: rekor-redis
1044+
- image: registry.redhat.io/rhtas/rekor-server-rhel9@sha256:81e10e34f02b21bb8295e7b5c93797fc8c0e43a1a0d8304cca1b07415a3ed6f5
1045+
name: rekor-server
1046+
- image: registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:3c93c15fc5c918a91b3da9f5bf2276e4d46d881b1031287e6ab28e6aeb23e019
1047+
name: rekor-search-ui
1048+
- image: registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:6aa3ca40e0f9e32a0a211a930b21ff009b83e46609bfa5bb328979e4799d13c7
1049+
name: backfill-redis
1050+
- image: registry.redhat.io/rhtas/tuffer-rhel9@sha256:79340be7918034c68a334a210ab872161827c99c2a1551a4fce8d5d27560a234
1051+
name: tuf
1052+
- image: registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:31e7318a9b19ed04ef0f25949f1f1709d293b532316b27a06f83fa5174547b17
1053+
name: ctlog
1054+
- image: registry.access.redhat.com/ubi9/httpd-24@sha256:7874b82335a80269dcf99e5983c2330876f5fe8bdc33dc6aa4374958a2ffaaee
1055+
name: http-server
1056+
- image: registry.redhat.io/rhtas/segment-reporting-rhel9@sha256:1b87ff1ad02c476c08e06038a26af7abe61f177e491a9ff42d507550a8587ac8
1057+
name: segment-reporting
1058+
- image: registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:fce0a22c8872309554236bab3457715dda0a83eb40dc6a9ecd3477b8023369d0
1059+
name: timestamp-authority
1060+
- image: registry.redhat.io/rhtas/client-server-rhel9@sha256:9537329d0166b8d41ffd5f5d79c052fc27abe426a20cba5733c84030013c4e29
1061+
name: client-server
10011062
version: 1.2.0

‎bundle/manifests/rhtas-related-images-7tcdf9f446_v1_configmap.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: v1
2+
data:
3+
RELATED_IMAGE_BACKFILL_REDIS: registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:6aa3ca40e0f9e32a0a211a930b21ff009b83e46609bfa5bb328979e4799d13c7
4+
RELATED_IMAGE_CLIENT_SERVER: registry.redhat.io/rhtas/client-server-rhel9@sha256:9537329d0166b8d41ffd5f5d79c052fc27abe426a20cba5733c84030013c4e29
5+
RELATED_IMAGE_CTLOG: registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:31e7318a9b19ed04ef0f25949f1f1709d293b532316b27a06f83fa5174547b17
6+
RELATED_IMAGE_FULCIO_SERVER: registry.redhat.io/rhtas/fulcio-rhel9@sha256:4b5765bbfd3dac5fa027d2fb3d672b6ebffbc573b9413ab4cb189c50fa6f9a09
7+
RELATED_IMAGE_HTTP_SERVER: registry.access.redhat.com/ubi9/httpd-24@sha256:7874b82335a80269dcf99e5983c2330876f5fe8bdc33dc6aa4374958a2ffaaee
8+
RELATED_IMAGE_REKOR_REDIS: registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:18820b1fbdbc2cc3e917822974910332d937b03cfe781628bd986fd6a5ee318e
9+
RELATED_IMAGE_REKOR_SEARCH_UI: registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:3c93c15fc5c918a91b3da9f5bf2276e4d46d881b1031287e6ab28e6aeb23e019
10+
RELATED_IMAGE_REKOR_SERVER: registry.redhat.io/rhtas/rekor-server-rhel9@sha256:81e10e34f02b21bb8295e7b5c93797fc8c0e43a1a0d8304cca1b07415a3ed6f5
11+
RELATED_IMAGE_SEGMENT_REPORTING: registry.redhat.io/rhtas/segment-reporting-rhel9@sha256:1b87ff1ad02c476c08e06038a26af7abe61f177e491a9ff42d507550a8587ac8
12+
RELATED_IMAGE_TIMESTAMP_AUTHORITY: registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:fce0a22c8872309554236bab3457715dda0a83eb40dc6a9ecd3477b8023369d0
13+
RELATED_IMAGE_TRILLIAN_DB: registry.redhat.io/rhtas/trillian-database-rhel9@sha256:501612745e63e5504017079388bec191ffacf00ffdebde7be6ca5b8e4fd9d323
14+
RELATED_IMAGE_TRILLIAN_LOG_SERVER: registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:7af78c7bc4df097ffeeef345f1d13289695f715221957579ee65daeef2fa3f5b
15+
RELATED_IMAGE_TRILLIAN_LOG_SIGNER: registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:2d707d12e4f65e1a92b4de11465a5976d55e15ad6c9fefe994646ccd44c83840
16+
RELATED_IMAGE_TRILLIAN_NETCAT: registry.redhat.io/openshift4/ose-tools-rhel8@sha256:486b4d2dd0d10c5ef0212714c94334e04fe8a3d36cf619881986201a50f123c7
17+
RELATED_IMAGE_TUF: registry.redhat.io/rhtas/tuffer-rhel9@sha256:79340be7918034c68a334a210ab872161827c99c2a1551a4fce8d5d27560a234
18+
kind: ConfigMap
19+
metadata:
20+
name: rhtas-related-images-7tcdf9f446

‎cmd/main.go

+17-15
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ import (
2020
"crypto/tls"
2121
"flag"
2222

23+
"github.com/securesign/operator/internal/images"
24+
2325
"net/http"
2426
"os"
2527
"strconv"
@@ -104,22 +106,22 @@ func main() {
104106
"If set, HTTP/2 will be enabled for the metrics and webhook servers")
105107
flag.Int64Var(&constants.CreateTreeDeadline, "create-tree-deadline", constants.CreateTreeDeadline, "The time allowance (in seconds) for the create tree job to run before failing.")
106108
utils.BoolFlagOrEnv(&constants.Openshift, "openshift", "OPENSHIFT", false, "Enable to ensures the operator applies OpenShift specific configurations.")
107-
utils.StringFlagOrEnv(&constants.TrillianLogSignerImage, "trillian-log-signer-image", "TRILLIAN_LOG_SIGNER_IMAGE", constants.TrillianLogSignerImage, "The image used for trillian log signer.")
108-
utils.StringFlagOrEnv(&constants.TrillianServerImage, "trillian-log-server-image", "TRILLIAN_LOG_SERVER_IMAGE", constants.TrillianServerImage, "The image used for trillian log server.")
109-
utils.StringFlagOrEnv(&constants.TrillianDbImage, "trillian-db-image", "TRILLIAN_DB_IMAGE", constants.TrillianDbImage, "The image used for trillian's database.")
110-
utils.StringFlagOrEnv(&constants.TrillianNetcatImage, "trillian-netcat-image", "TRILLIAN_NETCAT_IMAGE", constants.TrillianNetcatImage, "The image used for trillian netcat.")
111-
utils.StringFlagOrEnv(&constants.FulcioServerImage, "fulcio-server-image", "FULCIO_SERVER_IMAGE", constants.FulcioServerImage, "The image used for the fulcio server.")
112-
utils.StringFlagOrEnv(&constants.RekorRedisImage, "rekor-redis-image", "REKOR_REDIS_IMAGE", constants.RekorRedisImage, "The image used for redis.")
113-
utils.StringFlagOrEnv(&constants.RekorServerImage, "rekor-server-image", "REKOR_SERVER_IMAGE", constants.RekorServerImage, "The image used for rekor server.")
114-
utils.StringFlagOrEnv(&constants.RekorSearchUiImage, "rekor-search-ui-image", "REKOR_SEARCH_UI_IMAGE", constants.RekorSearchUiImage, "The image used for rekor search ui.")
115-
utils.StringFlagOrEnv(&constants.BackfillRedisImage, "backfill-redis-image", "BACKFILL_REDIS_IMAGE", constants.BackfillRedisImage, "The image used for backfill redis.")
116-
utils.StringFlagOrEnv(&constants.TufImage, "tuf-image", "TUF_IMAGE", constants.TufImage, "The image used for TUF.")
117-
utils.StringFlagOrEnv(&constants.CTLogImage, "ctlog-image", "CTLOG_IMAGE", constants.CTLogImage, "The image used for ctlog.")
118-
utils.StringFlagOrEnv(&constants.HttpServerImage, "http-server-image", "HTTP_SERVER_IMAGE", constants.HttpServerImage, "The image used to serve our cli binary's.")
119-
utils.StringFlagOrEnv(&constants.ClientServerImage, "client-server-image", "CLIENT_SERVER_IMAGE", constants.ClientServerImage, "The image used to serve cosign and gitsign.")
120-
utils.StringFlagOrEnv(&constants.SegmentBackupImage, "segment-backup-job-image", "SEGMENT_BACKUP_JOB_IMAGE", constants.SegmentBackupImage, "The image used for the segment backup job")
109+
utils.RelatedImageFlag("trillian-log-signer-image", images.TrillianLogSigner, "The image used for trillian log signer.")
110+
utils.RelatedImageFlag("trillian-log-server-image", images.TrillianServer, "The image used for trillian log server.")
111+
utils.RelatedImageFlag("trillian-db-image", images.TrillianDb, "The image used for trillian's database.")
112+
utils.RelatedImageFlag("trillian-netcat-image", images.TrillianNetcat, "The image used for trillian netcat.")
113+
utils.RelatedImageFlag("fulcio-server-image", images.FulcioServer, "The image used for the fulcio server.")
114+
utils.RelatedImageFlag("rekor-redis-image", images.RekorRedis, "The image used for redis.")
115+
utils.RelatedImageFlag("rekor-server-image", images.RekorServer, "The image used for rekor server.")
116+
utils.RelatedImageFlag("rekor-search-ui-image", images.RekorSearchUi, "The image used for rekor search ui.")
117+
utils.RelatedImageFlag("backfill-redis-image", images.BackfillRedis, "The image used for backfill redis.")
118+
utils.RelatedImageFlag("tuf-image", images.Tuf, "The image used for TUF.")
119+
utils.RelatedImageFlag("ctlog-image", images.CTLog, "The image used for ctlog.")
120+
utils.RelatedImageFlag("http-server-image", images.HttpServer, "The image used to serve our cli binary's.")
121+
utils.RelatedImageFlag("client-server-image", images.ClientServer, "The image used to serve cosign and gitsign.")
122+
utils.RelatedImageFlag("segment-backup-job-image", images.SegmentBackup, "The image used for the segment backup job")
123+
utils.RelatedImageFlag("timestamp-authority-image", images.TimestampAuthority, "The image used for Timestamp Authority")
121124
flag.StringVar(&clidownload.CliHostName, "cli-server-hostname", "", "The hostname for the cli server")
122-
utils.StringFlagOrEnv(&constants.TimestampAuthorityImage, "timestamp-authority-image", "TIMESTAMP_AUTHORITY_IMAGE", constants.TimestampAuthorityImage, "The image used for Timestamp Authority")
123125

124126
klog.InitFlags(flag.CommandLine)
125127
flag.Parse()

‎config/default/images.env

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../internal/images/images.env

0 commit comments

Comments
 (0)