Skip to content

Commit 6e61b83

Browse files
wallrj-cyberarkwallrj-cyberark
committed
build(release): update release process for CyberArk Discovery and Context
- Add ARK image and chart outputs to GitHub Actions workflow - Refactor Makefile variables for ARK image/chart repositories and digests - Update image annotations for CyberArk branding and documentation links - Adjust e2e test script to use new ARK image/chart variables - Remove unused OCI_BASE variable from root Makefile Signed-off-by: Richard Wall <[email protected]>
1 parent cf3ad78 commit 6e61b83

File tree

6 files changed

+67
-39
lines changed

6 files changed

+67
-39
lines changed

‎.github/workflows/release.yml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,13 +37,19 @@ jobs:
3737
go-version: ${{ steps.go-version.outputs.result }}
3838

3939
- id: release
40-
run: make release
40+
run: make release ark-release
4141

4242
outputs:
4343
RELEASE_OCI_PREFLIGHT_IMAGE: ${{ steps.release.outputs.RELEASE_OCI_PREFLIGHT_IMAGE }}
4444
RELEASE_OCI_PREFLIGHT_TAG: ${{ steps.release.outputs.RELEASE_OCI_PREFLIGHT_TAG }}
4545
RELEASE_HELM_CHART_IMAGE: ${{ steps.release.outputs.RELEASE_HELM_CHART_IMAGE }}
4646
RELEASE_HELM_CHART_VERSION: ${{ steps.release.outputs.RELEASE_HELM_CHART_VERSION }}
47+
ARK_IMAGE: ${{ steps.release.outputs.ARK_IMAGE }}
48+
ARK_IMAGE_TAG: ${{ steps.release.outputs.ARK_IMAGE_TAG }}
49+
ARK_IMAGE_DIGEST: ${{ steps.release.outputs.ARK_IMAGE_DIGEST }}
50+
ARK_CHART: ${{ steps.release.outputs.ARK_CHART }}
51+
ARK_CHART_TAG: ${{ steps.release.outputs.ARK_CHART_TAG }}
52+
ARK_CHART_DIGEST: ${{ steps.release.outputs.ARK_CHART_DIGEST }}
4753

4854
github_release:
4955
runs-on: ubuntu-latest
@@ -61,6 +67,12 @@ jobs:
6167
echo "OCI_PREFLIGHT_TAG: ${{ needs.build_and_push.outputs.RELEASE_OCI_PREFLIGHT_TAG }}" >> .notes-file
6268
echo "HELM_CHART_IMAGE: ${{ needs.build_and_push.outputs.RELEASE_HELM_CHART_IMAGE }}" >> .notes-file
6369
echo "HELM_CHART_VERSION: ${{ needs.build_and_push.outputs.RELEASE_HELM_CHART_VERSION }}" >> .notes-file
70+
echo "ARK_IMAGE: ${{ needs.build_and_push.outputs.ARK_IMAGE }}" >> .notes-file
71+
echo "ARK_IMAGE_TAG: ${{ needs.build_and_push.outputs.ARK_IMAGE_TAG }}" >> .notes-file
72+
echo "ARK_IMAGE_DIGEST: ${{ needs.build_and_push.outputs.ARK_IMAGE_DIGEST }}" >> .notes-file
73+
echo "ARK_CHART: ${{ needs.build_and_push.outputs.ARK_CHART }}" >> .notes-file
74+
echo "ARK_CHART_TAG: ${{ needs.build_and_push.outputs.ARK_CHART_TAG }}" >> .notes-file
75+
echo "ARK_CHART_DIGEST: ${{ needs.build_and_push.outputs.ARK_CHART_DIGEST }}" >> .notes-file
6476
6577
- env:
6678
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎RELEASE.md‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,11 @@ The release process is semi-automated.
1010
> [!NOTE]
1111
>
1212
> Upon pushing the tag, a GitHub Action will do the following:
13-
> - Build and publish the container image at `quay.io/jetstack/venafi-agent`,
14-
> - Build and publish the Helm chart at `oci://quay.io/jetstack/charts/venafi-kubernetes-agent`,
13+
> - Build and publish the container image: `quay.io/jetstack/venafi-agent`,
14+
> - Build and publish the Helm chart: `oci://quay.io/jetstack/charts/venafi-kubernetes-agent`,
15+
> - Build and publish the container image: `quay.io/jetstack/cyberark-disco-agent`,
16+
> - Build and publish the Helm chart: `oci://quay.io/jetstack/charts/cyberark-disco-agent`,
1517
> - Create a draft GitHub release,
16-
> - Upload the Helm chart tarball to the GitHub release.
1718
1819
1. Upgrade the Go dependencies.
1920

@@ -71,18 +72,20 @@ The release process is semi-automated.
7172

7273
For context, the new tag will create the following images:
7374

74-
| Image | Automation |
75-
| --------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
75+
| Image | Automation |
76+
|-----------------------------------------------------------|----------------------------------------------------------------------------------------------|
7677
| `quay.io/jetstack/venafi-agent` | Automatically built by the [release action](.github/workflows/release.yml) on Git tag pushes |
78+
| `quay.io/jetstack/cyberark-disco-agent` | Automatically built by the [release action](.github/workflows/release.yml) on Git tag pushes |
7779
| `registry.venafi.cloud/venafi-agent/venafi-agent` | Automatically mirrored by Harbor Replication rule |
7880
| `private-registry.venafi.cloud/venafi-agent/venafi-agent` | Automatically mirrored by Harbor Replication rule |
7981
| `private-registry.venafi.eu/venafi-agent/venafi-agent` | Automatically mirrored by Harbor Replication rule |
8082

8183
and the following OCI Helm charts:
8284

8385
| Helm Chart | Automation |
84-
| -------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
86+
|----------------------------------------------------------------------|----------------------------------------------------------------------------------------------|
8587
| `oci://quay.io/jetstack/charts/venafi-kubernetes-agent` | Automatically built by the [release action](.github/workflows/release.yml) on Git tag pushes |
88+
| `oci://quay.io/jetstack/charts/cyberark-disco-agent` | Automatically built by the [release action](.github/workflows/release.yml) on Git tag pushes |
8689
| `oci://registry.venafi.cloud/charts/venafi-kubernetes-agent` | Automatically mirrored by Harbor Replication rule |
8790
| `oci://private-registry.venafi.cloud/charts/venafi-kubernetes-agent` | Automatically mirrored by Harbor Replication rule |
8891
| `oci://private-registry.venafi.eu/charts/venafi-kubernetes-agent` | Automatically mirrored by Harbor Replication rule |
@@ -118,3 +121,7 @@ v1.1.0 (Git tag in the jetstack-secure repo)
118121
### Step 2: Test the Helm chart "venafi-kubernetes-agent" with venctl connect
119122

120123
NOTE(mael): TBD
124+
125+
### Step 3: Test the Helm chart "cyberark-disco-agent"
126+
127+
NOTE(wallrj): TBD

‎hack/ark/test-e2e.sh‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,11 @@ trap 'rm -rf "${tmp_dir}"' EXIT
4343

4444
pushd "${tmp_dir}"
4545
> release.env
46-
make -C "$root_dir" ark-release GITHUB_OUTPUT="${tmp_dir}/release.env"
46+
make -C "$root_dir" ark-release \
47+
GITHUB_OUTPUT="${tmp_dir}/release.env" \
48+
OCI_SIGN_ON_PUSH=false \
49+
oci_platforms="" \
50+
ARK_OCI_BASE="${OCI_BASE}"
4751
cat release.env
4852
source release.env
4953

@@ -61,15 +65,15 @@ kubectl create secret generic agent-credentials \
6165
--from-literal=ARK_SUBDOMAIN=$ARK_SUBDOMAIN \
6266
--from-literal=ARK_DISCOVERY_API=$ARK_DISCOVERY_API
6367

64-
helm upgrade agent "oci://${RELEASE_OCI_CHART}@${RELEASE_OCI_CHART_DIGEST}" \
65-
--version "${RELEASE_OCI_CHART_TAG}" \
68+
helm upgrade agent "oci://${ARK_CHART}@${ARK_CHART_DIGEST}" \
69+
--version "${ARK_CHART_TAG}" \
6670
--install \
6771
--wait \
6872
--create-namespace \
6973
--namespace "$NAMESPACE" \
7074
--set pprof.enabled=true \
7175
--set fullnameOverride=disco-agent \
72-
--set "image.digest=${RELEASE_OCI_IMAGE_DIGEST}" \
76+
--set "image.digest=${ARK_IMAGE_DIGEST}" \
7377
--set-json "podLabels={\"disco-agent.cyberark.cloud/test-id\": \"${RANDOM}\"}"
7478

7579
kubectl rollout status deployments/disco-agent --namespace "${NAMESPACE}"

‎make/00_mod.mk‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,6 @@ repo_name := github.com/jetstack/jetstack-secure
66
# third-party modules.
77
generate-golangci-lint-config: repo_name := github.com/jetstack/preflight
88

9-
OCI_BASE ?= # default to an empty value to avoid warnings
10-
119
license_ignore := gitlab.com/venafi,github.com/jetstack
1210

1311
kind_cluster_name := preflight

‎make/ark/00_mod.mk‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,20 +7,20 @@ go_ark_ldflags := \
77
-X $(repo_name)/pkg/version.BuildDate=$(shell date "+%F-%T-%Z") \
88

99
oci_ark_base_image_flavor := static
10-
oci_ark_image_name := quay.io/jetstack/ark-agent
10+
oci_ark_image_name := quay.io/jetstack/cyberark-disco-agent
1111
oci_ark_image_tag := $(VERSION)
12-
oci_ark_image_name_development := jetstack.local/ark-agent
12+
oci_ark_image_name_development := jetstack.local/cyberark-disco-agent
1313

1414
# Annotations are the standardised set of annotations we set on every component we publish
1515
oci_ark_build_args := \
1616
--image-annotation="org.opencontainers.image.source"="https://github.com/jetstack/jetstack-secure" \
1717
--image-annotation="org.opencontainers.image.vendor"="CyberArk Software Ltd." \
1818
--image-annotation="org.opencontainers.image.licenses"="EULA - https://www.cyberark.com/contract-terms/" \
19-
--image-annotation="org.opencontainers.image.authors"="TODO" \
19+
--image-annotation="org.opencontainers.image.authors"="CyberArk Software Ltd." \
2020
--image-annotation="org.opencontainers.image.title"="CyberArk Discovery and Context Agent" \
2121
--image-annotation="org.opencontainers.image.description"="Gathers machine identity data from Kubernetes clusters." \
22-
--image-annotation="org.opencontainers.image.url"="TODO" \
23-
--image-annotation="org.opencontainers.image.documentation"="TODO" \
22+
--image-annotation="org.opencontainers.image.url"="https://www.cyberark.com/products/" \
23+
--image-annotation="org.opencontainers.image.documentation"="https://docs.cyberark.com" \
2424
--image-annotation="org.opencontainers.image.version"="$(VERSION)" \
2525
--image-annotation="org.opencontainers.image.revision"="$(GITCOMMIT)"
2626

‎make/ark/02_mod.mk‎

Lines changed: 28 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,38 @@
1+
# Makefile targets for CyberArk Discovery and Context
2+
3+
# The base OCI repository for all CyberArk Discovery and Context artifacts
4+
ARK_OCI_BASE ?= quay.io/jetstack
5+
6+
# The OCI repository (without tag) for the CyberArk Discovery and Context Agent Docker image
7+
# Can be overridden when calling `make ark-release` to push to a different repository.
8+
ARK_IMAGE ?= $(ARK_OCI_BASE)/cyberark-disco-agent
9+
10+
# The OCI repository (without tag) for the CyberArk Discovery and Context Helm chart
11+
# Can be overridden when calling `make ark-release` to push to a different repository.
12+
ARK_CHART ?= $(ARK_OCI_BASE)/charts/cyberark-disco-agent
13+
14+
# Used to output variables when running in GitHub Actions
115
GITHUB_OUTPUT ?= /dev/stderr
16+
217
.PHONY: ark-release
318
## Publish all release artifacts (image + helm chart)
419
## @category CyberArk Discovery and Context
5-
ark-release: oci_ark_image_name := $(OCI_BASE)/images/cyberark-disco-agent
6-
ark-release: OCI_SIGN_ON_PUSH := false
7-
ark-release: oci_platforms := linux/amd64
8-
ark-release: helm_chart_source_dir := deploy/charts/cyberark-disco-agent
9-
ark-release: helm_chart_image_name := $(OCI_BASE)/charts/cyberark-disco-agent
10-
ark-release: helm_chart_version := $(helm_chart_version)
1120
ark-release: oci_ark_image_digest_path := $(bin_dir)/scratch/image/oci-layout-ark.digests
1221
ark-release: helm_digest_path := $(bin_dir)/scratch/helm/cyberark-disco-agent-$(helm_chart_version).digests
1322
ark-release:
1423
$(MAKE) oci-push-ark helm-chart-oci-push \
15-
oci_ark_image_name="$(oci_ark_image_name)" \
16-
OCI_SIGN_ON_PUSH="$(OCI_SIGN_ON_PUSH)" \
17-
oci_platforms="$(oci_platforms)" \
18-
helm_image_name="$(oci_ark_image_name)" \
24+
oci_ark_image_name="$(ARK_IMAGE)" \
25+
helm_image_name="$(ARK_IMAGE)" \
1926
helm_image_tag="$(oci_ark_image_tag)" \
20-
helm_chart_source_dir="$(helm_chart_source_dir)" \
21-
helm_chart_image_name="$(helm_chart_image_name)"
27+
helm_chart_source_dir=deploy/charts/cyberark-disco-agent \
28+
helm_chart_image_name="$(ARK_CHART)"
2229

23-
@echo "RELEASE_OCI_IMAGE=$(oci_ark_image_name)" >> "$(GITHUB_OUTPUT)"
24-
@echo "RELEASE_OCI_IMAGE_TAG=$(oci_ark_image_tag)" >> "$(GITHUB_OUTPUT)"
25-
@echo "RELEASE_OCI_IMAGE_DIGEST=$$(head -1 $(oci_ark_image_digest_path))" >> "$(GITHUB_OUTPUT)"
26-
@echo "RELEASE_OCI_CHART=$(helm_chart_image_name)" >> "$(GITHUB_OUTPUT)"
27-
@echo "RELEASE_OCI_CHART_TAG=$(helm_chart_version)" >> "$(GITHUB_OUTPUT)"
28-
@echo "RELEASE_OCI_CHART_DIGEST=$$(head -1 $(helm_digest_path))" >> "$(GITHUB_OUTPUT)"
30+
@echo "ARK_IMAGE=$(ARK_IMAGE)" >> "$(GITHUB_OUTPUT)"
31+
@echo "ARK_IMAGE_TAG=$(oci_ark_image_tag)" >> "$(GITHUB_OUTPUT)"
32+
@echo "ARK_IMAGE_DIGEST=$$(head -1 $(oci_ark_image_digest_path))" >> "$(GITHUB_OUTPUT)"
33+
@echo "ARK_CHART=$(ARK_CHART)" >> "$(GITHUB_OUTPUT)"
34+
@echo "ARK_CHART_TAG=$(helm_chart_version)" >> "$(GITHUB_OUTPUT)"
35+
@echo "ARK_CHART_DIGEST=$$(head -1 $(helm_digest_path))" >> "$(GITHUB_OUTPUT)"
2936

3037
@echo "Release complete!"
3138

@@ -40,11 +47,11 @@ ark-test-e2e: $(NEEDS_KIND) $(NEEDS_KUBECTL) $(NEEDS_HELM)
4047
## Verify the Helm chart
4148
## @category CyberArk Discovery and Context
4249
ark-verify:
43-
$(MAKE) verify-helm-lint verify-helm-values verify-pod-security-standards verify-helm-kubeconform\
50+
$(MAKE) verify-helm-lint verify-helm-values verify-pod-security-standards verify-helm-kubeconform \
4451
helm_chart_source_dir=deploy/charts/cyberark-disco-agent \
45-
helm_chart_image_name=$(OCI_BASE)/charts/cyberark-disco-agent
52+
helm_chart_image_name=$(ARK_CHART)
4653

47-
shared_verify_targets_dirty += ark-verify
54+
shared_verify_targets += ark-verify
4855

4956
.PHONY: ark-generate
5057
## Generate Helm chart documentation and schema

0 commit comments

Comments
 (0)