Skip to content

Commit 43f0fb1

Browse files
dhaiducekopenshift-merge-bot[bot]
dhaiducek
authored and
openshift-merge-bot[bot]
committed
stolostron patches
- Add OWNERS file - Enable CGO explicitly - Update to multi-arch Dockerfile - Use the `distroless/base-debian12` image for CGO - Workflow to build/push to quay.io - Workflow for Sonarcloud scanning - Add Konflux build file Signed-off-by: Dale Haiducek <[email protected]>
1 parent 35f8bb9 commit 43f0fb1

26 files changed

+313
-49
lines changed

‎.github/renovate.json

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
3+
"dockerfile": {
4+
"ignorePaths": [
5+
"crd.Dockerfile",
6+
"build/tooling/Dockerfile"
7+
]
8+
},
9+
"packageRules": [
10+
{
11+
"matchManagers": "helm-values",
12+
"enabled": false
13+
}
14+
],
15+
"schedule": "before 8am on Monday",
16+
"timezone": "America/New_York"
17+
}

‎.github/workflows/build-push-stolostron.yaml

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: build and push to quay
2+
3+
on:
4+
push:
5+
tags:
6+
- 'v*' # tags matching v*, i.e. v0.0.1, v1.0.0-rc.0
7+
8+
jobs:
9+
build:
10+
name: Image build and push
11+
runs-on: ubuntu-latest
12+
13+
steps:
14+
- uses: actions/checkout@v4
15+
16+
- uses: docker/login-action@v2
17+
with:
18+
registry: quay.io
19+
username: ${{ secrets.QUAY_USER }}
20+
password: ${{ secrets.QUAY_PASSWORD }}
21+
22+
- name: build and push
23+
run: |
24+
REPOSITORY="quay.io/gatekeeper/gatekeeper" \
25+
PLATFORM="linux/amd64,linux/arm64,linux/arm/v8" \
26+
OUTPUT_TYPE=type=registry GENERATE_ATTESTATIONS=true \
27+
make docker-buildx-release
28+

‎.github/workflows/gosec.yaml

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: GoSec scan
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
- release-[0-9]+.[0-9]+
8+
pull_request:
9+
branches:
10+
- master
11+
- release-[0-9]+.[0-9]+
12+
13+
jobs:
14+
gosec:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Checkout Gatekeeper
18+
uses: actions/checkout@v4
19+
- name: Run Gosec Security Scanner
20+
uses: securego/[email protected]
21+
with:
22+
args: -no-fail -fmt sonarqube -out gosec.json -stdout -exclude-dir=.go -exclude-dir=test ./...
23+
- name: Upload artifacts
24+
uses: actions/upload-artifact@v4
25+
with:
26+
name: artifacts
27+
path: gosec.json

‎.github/workflows/sonarcloud.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
name: Sonarcloud scan
2+
3+
on:
4+
workflow_run:
5+
workflows:
6+
- GoSec scan
7+
types:
8+
- completed
9+
10+
jobs:
11+
sonarcloud:
12+
uses: stolostron/governance-policy-framework/.github/workflows/sonarcloud.yml@main
13+
secrets:
14+
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

‎.github/workflows/workflow.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
build_test:
3030
name: "Build and Test"
3131
runs-on: ubuntu-22.04
32-
timeout-minutes: 15
32+
timeout-minutes: 20
3333
strategy:
3434
fail-fast: false
3535
matrix:
@@ -90,7 +90,7 @@ jobs:
9090
helm_build_test:
9191
name: "[Helm] Build and Test"
9292
runs-on: ubuntu-22.04
93-
timeout-minutes: 15
93+
timeout-minutes: 20
9494
strategy:
9595
fail-fast: false
9696
matrix:
@@ -160,7 +160,7 @@ jobs:
160160
build_test_generator_expansion:
161161
name: "[Generator Resource Expansion] Build and Test"
162162
runs-on: ubuntu-22.04
163-
timeout-minutes: 15
163+
timeout-minutes: 20
164164

165165
steps:
166166
- name: Harden Runner

‎.go-version

+1-1
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.22.0
1+
1.23.6

‎Dockerfile

+33-5
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM --platform=$BUILDPLATFORM golang:1.23-bookworm@sha256:3f3b9daa3de608f3e869cd2ff8baf21555cf0fca9fd34251b8f340f9b7c30ec5 AS builder
1+
FROM --platform=$BUILDPLATFORM golang:1.23-bookworm@sha256:462f68e1109cc0415f58ba591f11e650b38e193fddc4a683a3b77d29be8bfb2c AS builder
22

33
ARG TARGETPLATFORM
44
ARG TARGETOS
@@ -8,17 +8,45 @@ ARG LDFLAGS
88
ARG BUILDKIT_SBOM_SCAN_STAGE=true
99

1010
ENV GO111MODULE=on \
11-
CGO_ENABLED=0 \
11+
CGO_ENABLED=1 \
1212
GOOS=${TARGETOS} \
1313
GOARCH=${TARGETARCH} \
1414
GOARM=${TARGETVARIANT}
1515

16+
RUN if [ "${TARGETPLATFORM}" = "linux/arm64" ]; then \
17+
apt -y update && apt -y install gcc-aarch64-linux-gnu && apt -y clean all; \
18+
elif [ "${TARGETPLATFORM}" = "linux/arm/v8" ]; then \
19+
apt -y update && apt -y install gcc-arm-linux-gnueabihf && apt -y clean all; \
20+
fi
21+
1622
WORKDIR /go/src/github.com/open-policy-agent/gatekeeper
17-
COPY . .
1823

19-
RUN go build -mod vendor -a -ldflags "${LDFLAGS}" -o manager
24+
# Copy the Go module manifests and dependencies
25+
COPY go.mod go.mod
26+
COPY go.sum go.sum
27+
COPY vendor/ vendor/
28+
29+
# Copy the source code
30+
COPY main.go main.go
31+
COPY apis/ apis/
32+
COPY pkg/ pkg/
33+
34+
35+
# Build the controller
36+
RUN if [ "${TARGETPLATFORM}" = "linux/arm64" ]; then \
37+
export CC=aarch64-linux-gnu-gcc; \
38+
elif [ "${TARGETPLATFORM}" = "linux/arm/v8" ]; then \
39+
export CC=arm-linux-gnueabihf-gcc; \
40+
fi; \
41+
go build -mod vendor -a -ldflags "${LDFLAGS}" -o manager
42+
2043

21-
FROM gcr.io/distroless/static-debian12@sha256:f4a57e8ffd7ba407bdd0eb315bb54ef1f21a2100a7f032e9102e4da34fe7c196
44+
# Use distroless as minimal base image to package the manager binary
45+
# Refer to https://github.com/GoogleContainerTools/distroless for more details
46+
#
47+
# CGO_ENABLED requires the 'base' image:
48+
# - https://github.com/GoogleContainerTools/distroless/blob/main/base/README.md
49+
FROM gcr.io/distroless/base-debian12:nonroot
2250

2351
WORKDIR /
2452
COPY --from=builder /go/src/github.com/open-policy-agent/gatekeeper/manager .

‎OWNERS

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
approvers:
2+
- dhaiducek
3+
- gparvin
4+
- JustinKuli
5+
- yiraeChristineKim
6+
reviewers:
7+
- dhaiducek
8+
- gparvin
9+
- JustinKuli
10+
- yiraeChristineKim

‎README.md

+4
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,7 @@ This project is governed by the [CNCF Code of conduct](https://github.com/cncf/f
3636
## Security
3737

3838
For details on how to report vulnerabilities and security release process, please refer to [Gatekeeper Security](https://open-policy-agent.github.io/gatekeeper/website/docs/security) for more information.
39+
40+
<!---
41+
Date: 01/29/2025
42+
-->

‎Tiltfile

+3-3
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,13 @@ if settings.get("trigger_mode", "auto").lower() == "manual":
1717
trigger_mode(TRIGGER_MODE_MANUAL)
1818

1919
TILT_DOCKERFILE = """
20-
FROM golang:1.23-bookworm as tilt-helper
20+
FROM golang:1.23-bookworm AS tilt-helper
2121
# Support live reloading with Tilt
2222
RUN wget --output-document /restart.sh --quiet https://raw.githubusercontent.com/tilt-dev/rerun-process-wrapper/60eaa572cdf825c646008e1ea28b635f83cefb38/restart.sh && \
2323
wget --output-document /start.sh --quiet https://raw.githubusercontent.com/tilt-dev/rerun-process-wrapper/60eaa572cdf825c646008e1ea28b635f83cefb38/start.sh && \
2424
chmod +x /start.sh && chmod +x /restart.sh
2525
26-
FROM gcr.io/distroless/base:debug as tilt
26+
FROM gcr.io/distroless/base:debug AS tilt
2727
WORKDIR /
2828
COPY --from=tilt-helper /start.sh .
2929
COPY --from=tilt-helper /restart.sh .
@@ -34,7 +34,7 @@ COPY bin/manager .
3434
def build_manager():
3535
cmd = [
3636
"make tilt-prepare",
37-
"GO111MODULE=on CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -mod vendor -a -o .tiltbuild/bin/manager",
37+
"GO111MODULE=on CGO_ENABLED=1 GOOS=linux GOARCH=amd64 go build -mod vendor -a -o .tiltbuild/bin/manager",
3838
]
3939
local_resource(
4040
"manager",

‎build/Dockerfile.rhtap

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.23 AS builder
2+
ENV LDFLAGS="-X github.com/open-policy-agent/gatekeeper/v3/pkg/version.Version=v3.18.2" \
3+
GO111MODULE=on \
4+
CGO_ENABLED=1
5+
6+
WORKDIR /go/src/github.com/open-policy-agent/gatekeeper
7+
8+
# Copy the Go module manifests and dependencies
9+
COPY go.mod go.mod
10+
COPY go.sum go.sum
11+
COPY vendor/ vendor/
12+
13+
# Copy the source code
14+
COPY main.go main.go
15+
COPY apis/ apis/
16+
COPY pkg/ pkg/
17+
18+
# Build the controller
19+
RUN go build -mod vendor -a -ldflags "${LDFLAGS}" -o manager
20+
21+
22+
# Copy the binary to the UBI-minimal base image
23+
FROM registry.access.redhat.com/ubi9/ubi-minimal:latest
24+
WORKDIR /
25+
COPY --from=builder /go/src/github.com/open-policy-agent/gatekeeper/manager .
26+
27+
RUN mkdir licenses/
28+
COPY LICENSE licenses/
29+
30+
USER 65532:65532
31+
32+
ENTRYPOINT ["/manager"]

‎build/tooling/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.23-bookworm@sha256:3f3b9daa3de608f3e869cd2ff8baf21555cf0fca9fd34251b8f340f9b7c30ec5
1+
FROM golang:1.23-bookworm@sha256:462f68e1109cc0415f58ba591f11e650b38e193fddc4a683a3b77d29be8bfb2c
22

33
RUN GO111MODULE=on go install sigs.k8s.io/controller-tools/cmd/[email protected]
44
RUN GO111MODULE=on go install k8s.io/code-generator/cmd/[email protected]

‎config/manager/manager.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ spec:
5656
- "--operation=webhook"
5757
- "--operation=mutation-webhook"
5858
- "--disable-opa-builtin={http.send}"
59-
image: openpolicyagent/gatekeeper:v3.18.2
59+
image: quay.io/gatekeeper/gatekeeper:v3.18.2
6060
imagePullPolicy: Always
6161
name: manager
6262
ports:
@@ -151,7 +151,7 @@ spec:
151151
- --disable-cert-rotation
152152
command:
153153
- /manager
154-
image: openpolicyagent/gatekeeper:v3.18.2
154+
image: quay.io/gatekeeper/gatekeeper:v3.18.2
155155
env:
156156
# used by Gatekeeper
157157
- name: POD_NAMESPACE

‎gator.Dockerfile

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM --platform=$BUILDPLATFORM golang:1.23-bookworm@sha256:3f3b9daa3de608f3e869cd2ff8baf21555cf0fca9fd34251b8f340f9b7c30ec5 AS builder
1+
FROM --platform=$BUILDPLATFORM golang:1.23-bookworm@sha256:462f68e1109cc0415f58ba591f11e650b38e193fddc4a683a3b77d29be8bfb2c AS builder
22

33
ARG TARGETPLATFORM
44
ARG TARGETOS
@@ -7,7 +7,7 @@ ARG TARGETVARIANT=""
77
ARG LDFLAGS
88

99
ENV GO111MODULE=on \
10-
CGO_ENABLED=0 \
10+
CGO_ENABLED=1 \
1111
GOOS=${TARGETOS} \
1212
GOARCH=${TARGETARCH} \
1313
GOARM=${TARGETVARIANT}

‎go.mod

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/open-policy-agent/gatekeeper/v3
22

3-
go 1.22.0
3+
go 1.23.6
44

55
require (
66
cloud.google.com/go/trace v1.10.11
@@ -94,7 +94,7 @@ require (
9494
github.com/go-openapi/swag v0.23.0 // indirect
9595
github.com/gobwas/glob v0.2.3 // indirect
9696
github.com/gogo/protobuf v1.3.2 // indirect
97-
github.com/golang/glog v1.2.1 // indirect
97+
github.com/golang/glog v1.2.4 // indirect
9898
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
9999
github.com/google/cel-go v0.17.8 // indirect
100100
github.com/google/gnostic-models v0.6.8 // indirect

‎go.sum

+2-2
Original file line numberDiff line numberDiff line change
@@ -173,8 +173,8 @@ github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7a
173173
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
174174
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
175175
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
176-
github.com/golang/glog v1.2.1 h1:OptwRhECazUx5ix5TTWC3EZhsZEHWcYWY4FQHTIubm4=
177-
github.com/golang/glog v1.2.1/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
176+
github.com/golang/glog v1.2.4 h1:CNNw5U8lSiiBk7druxtSHHTsRWcxKoac6kZKm2peBBc=
177+
github.com/golang/glog v1.2.4/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
178178
github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
179179
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
180180
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=

‎manifest_staging/deploy/gatekeeper.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -5109,7 +5109,7 @@ spec:
51095109
value: manager
51105110
- name: OTEL_RESOURCE_ATTRIBUTES
51115111
value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME)
5112-
image: openpolicyagent/gatekeeper:v3.18.2
5112+
image: quay.io/gatekeeper/gatekeeper:v3.18.2
51135113
imagePullPolicy: Always
51145114
livenessProbe:
51155115
httpGet:
@@ -5228,7 +5228,7 @@ spec:
52285228
value: manager
52295229
- name: OTEL_RESOURCE_ATTRIBUTES
52305230
value: k8s.pod.name=$(POD_NAME),k8s.namespace.name=$(NAMESPACE),k8s.container.name=$(CONTAINER_NAME)
5231-
image: openpolicyagent/gatekeeper:v3.18.2
5231+
image: quay.io/gatekeeper/gatekeeper:v3.18.2
52325232
imagePullPolicy: Always
52335233
livenessProbe:
52345234
httpGet:

‎sonar-project.properties

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
sonar.projectKey=open-cluster-management_gatekeeper
2+
sonar.projectName=gatekeeper
3+
sonar.organization=open-cluster-management
4+
sonar.sources=.
5+
sonar.exclusions=**/*_test.go,**/*_generated*.go,**/*_generated/**,**/vendor/**,/test/**,/build/**,/vbh/**,/version/**
6+
sonar.tests=.
7+
sonar.test.inclusions=**/*_test.go
8+
sonar.test.exclusions=**/*_generated*.go,**/*_generated/**,**/vendor/**,**/test/e2e/**
9+
sonar.go.tests.reportPaths=report.json,report_e2e.json,report_unit.json
10+
sonar.go.coverage.reportPaths=coverage.out,coverage_e2e.out,coverage_unit.out
11+
sonar.externalIssuesReportPaths=gosec.json
12+
sonar.qualitygate.wait=true
13+
sonar.qualitygate.timeout=450

‎test/externaldata/dummy-provider/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM --platform=$BUILDPLATFORM golang:1.23-bookworm@sha256:3f3b9daa3de608f3e869cd2ff8baf21555cf0fca9fd34251b8f340f9b7c30ec5 as builder
1+
FROM --platform=$BUILDPLATFORM golang:1.23-bookworm@sha256:462f68e1109cc0415f58ba591f11e650b38e193fddc4a683a3b77d29be8bfb2c AS builder
22

33
ARG TARGETPLATFORM
44
ARG TARGETOS

‎test/image/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.23-bookworm@sha256:3f3b9daa3de608f3e869cd2ff8baf21555cf0fca9fd34251b8f340f9b7c30ec5 as builder
1+
FROM golang:1.23-bookworm@sha256:462f68e1109cc0415f58ba591f11e650b38e193fddc4a683a3b77d29be8bfb2c AS builder
22

33
ARG BATS_VERSION
44
ARG ORAS_VERSION

‎test/pubsub/fake-subscriber/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM --platform=$BUILDPLATFORM golang:1.22-bookworm@sha256:39b7e6ebaca464d51989858871f792f2e186dce8ce0cbdba7e88e4444b244407 as builder
1+
FROM --platform=$BUILDPLATFORM golang:1.23-bookworm@sha256:462f68e1109cc0415f58ba591f11e650b38e193fddc4a683a3b77d29be8bfb2c AS builder
22

33
ARG TARGETPLATFORM
44
ARG TARGETOS

‎vendor/github.com/golang/glog/glog.go

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)