diff --git a/.github/labeler.yml b/.github/labeler.yml index b9a78a1ba..b6501e297 100644 --- a/.github/labeler.yml +++ b/.github/labeler.yml @@ -15,8 +15,6 @@ # CLI utilities and operators, tagged understackctl/vX.Y.Z and friends - changed-files: - all-globs-to-all-files: ["go/understackctl/**"] - - changed-files: - - all-globs-to-all-files: ["go/nautobotop/**"] - changed-files: - all-globs-to-all-files: ["go/dexop/**"] - changed-files: diff --git a/.github/workflows/build-nautobotop.yaml b/.github/workflows/build-nautobotop.yaml deleted file mode 100644 index 491ce6e27..000000000 --- a/.github/workflows/build-nautobotop.yaml +++ /dev/null @@ -1,94 +0,0 @@ ---- -name: build-nautobotop-images - -on: - workflow_dispatch: - push: - tags: - - nautobotop-v* - paths: - - "go/nautobotop/**" - -jobs: - build-nautobotop: - runs-on: ubuntu-latest - permissions: - packages: write - contents: write - id-token: write - steps: - - name: Checkout - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - with: - fetch-depth: 0 - - - name: Install Go - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 - with: - go-version: '1.25' - cache: true - cache-dependency-path: 'go/nautobotop/go.sum' - - - name: Install syft - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2 - - - name: Install Cosign - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 - - - name: Set up QEMU - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4 - - - name: Login to ghcr.io - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 - with: - registry: "ghcr.io" - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Extract tag name - id: extract_tag - run: echo "tag=${GITHUB_REF#refs/tags/nautobotop-v}" >> $GITHUB_OUTPUT - - - name: Run GoReleaser - uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6 - with: - distribution: goreleaser - version: "~> v2" - args: release --clean --skip=validate - workdir: go/nautobotop - env: - GIT_REPO: ${{ github.repository }} - CUSTOM_TAG: ${{ steps.extract_tag.outputs.tag }} - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - chart: - runs-on: ubuntu-latest - needs: - - build-nautobotop - steps: - - name: Checkout repository - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 - - name: Log in to ghcr.io - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 - with: - registry: ghcr.io - username: '${{ github.actor }}' - password: '${{ secrets.GITHUB_TOKEN }}' - - name: Package and push Helm chart - working-directory: go/nautobotop - env: - PKG_VER: '${{ github.ref_name }}' - run: | - PKG_VER=${PKG_VER#nautobotop-v} - # update Chart.yaml with tag version - yq -i ".version = \"${PKG_VER}\"" helm/Chart.yaml - yq -i ".appVersion = \"${PKG_VER}\"" helm/Chart.yaml - yq helm/Chart.yaml - # package chart - helm package -u -d ${{ github.workspace }} helm - # push chart to ghcr.io - helm push ${{ github.workspace }}/nautobotop-${PKG_VER}.tgz \ - oci://ghcr.io/${GITHUB_REPOSITORY_OWNER}/charts diff --git a/.github/workflows/containers.yaml b/.github/workflows/containers.yaml index 954bece85..cd2f0cd91 100644 --- a/.github/workflows/containers.yaml +++ b/.github/workflows/containers.yaml @@ -13,6 +13,7 @@ on: - "containers/ironic-nautobot-client/**" - "containers/ironic-vnc-container/**" - "containers/openstack-sync-operator/**" + - "go/nautobotop/**" - "containers/understack-tests/**" - "python/**" - ".github/workflows/containers.yaml" @@ -47,6 +48,10 @@ jobs: target: prod - name: nautobot target: prod + - name: nautobotop + target: '' + dockerfile_path: ./go/nautobotop/Dockerfile + context_path: "./go/nautobotop/" uses: ./.github/workflows/build-container-reuse.yaml secrets: inherit with: diff --git a/RELEASING.md b/RELEASING.md index 55712e144..9d0120ffe 100644 --- a/RELEASING.md +++ b/RELEASING.md @@ -5,9 +5,12 @@ them. Pushing the tag triggers `containers.yaml` and `containers-openstack.yaml` to publish container images, and `release-notes.yaml` to assemble the release notes and create the GitHub release. -Per-artifact tags (`understackctl/vX.Y.Z`, `nautobotop-vX.Y.Z`, -`kubectl-us/vX.Y.Z`, `ironic-hardware-exporter/vX.Y.Z`, `dexop-vX.Y.Z`, -`ironic-ipxe/vX.Y.Z`) are released independently. See +`nautobotop` is released with the repository-wide tag: its image is built by +`containers.yaml` and its Helm chart is deployed straight from +`charts/nautobotop/` at `understack_ref`, like `openstack-sync-operator`. + +Per-artifact tags (`understackctl/vX.Y.Z`, `kubectl-us/vX.Y.Z`, +`ironic-hardware-exporter/vX.Y.Z`, `dexop-vX.Y.Z`, `ironic-ipxe/vX.Y.Z`) are released independently. See [Separately released artifacts](#separately-released-artifacts) below. ## Writing a release note diff --git a/charts/argocd-understack/templates/application-nautobotop.yaml b/charts/argocd-understack/templates/application-nautobotop.yaml index f4b9d98cc..3b4f33473 100644 --- a/charts/argocd-understack/templates/application-nautobotop.yaml +++ b/charts/argocd-understack/templates/application-nautobotop.yaml @@ -15,14 +15,24 @@ spec: server: {{ $.Values.cluster_server }} project: understack sources: - - chart: nautobotop + - path: charts/nautobotop + ref: understack + repoURL: {{ include "understack.understack_url" $ }} + targetRevision: {{ include "understack.understack_ref" $ }} helm: ignoreMissingValueFiles: true releaseName: nautobotop valueFiles: + - $understack/charts/nautobotop/values.yaml - $deploy/{{ include "understack.deploy_path" $ }}/nautobotop/values.yaml - repoURL: ghcr.io/rackerlabs/charts - targetRevision: {{ $.Values.global.nautobotop.chartVersion }} + {{- $ref := include "understack.understack_ref" $ }} + {{- if regexMatch "^v[0-9]+\\.[0-9]+\\.[0-9]+$" $ref }} + # Run the image built from the same release tag as the chart. Any other + # ref (HEAD, main, a branch) has no matching tag, so the chart uses latest. + parameters: + - name: understackRef + value: {{ $ref | quote }} + {{- end }} - path: {{ include "understack.deploy_path" $ }}/nautobotop ref: deploy repoURL: {{ include "understack.deploy_url" $ }} diff --git a/charts/argocd-understack/values.yaml b/charts/argocd-understack/values.yaml index b2b36e75e..0cb6c0e82 100644 --- a/charts/argocd-understack/values.yaml +++ b/charts/argocd-understack/values.yaml @@ -165,9 +165,6 @@ global: # -- Enable/disable deploying Nautobot Operator # @default -- false enabled: false - # -- Chart version for Nautobot Operator - # @default -- 0.0.3 - chartVersion: 0.0.3 # -- OpenEBS openebs: diff --git a/go/nautobotop/helm/.helmignore b/charts/nautobotop/.helmignore similarity index 100% rename from go/nautobotop/helm/.helmignore rename to charts/nautobotop/.helmignore diff --git a/go/nautobotop/helm/Chart.yaml b/charts/nautobotop/Chart.yaml similarity index 71% rename from go/nautobotop/helm/Chart.yaml rename to charts/nautobotop/Chart.yaml index 2ab3acaf4..cb8ac0a9c 100644 --- a/go/nautobotop/helm/Chart.yaml +++ b/charts/nautobotop/Chart.yaml @@ -14,8 +14,6 @@ type: application # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) version: 0.1.0 -# This is the version number of the application being deployed. This version number should be -# incremented each time you make changes to the application. Versions are not expected to -# follow Semantic Versioning. They should reflect the version the application is using. -# It is recommended to use it with quotes. -appVersion: 0.0.18 + +maintainers: + - name: rackerlabs diff --git a/go/nautobotop/helm/crds/clients.yaml b/charts/nautobotop/crds/clients.yaml similarity index 100% rename from go/nautobotop/helm/crds/clients.yaml rename to charts/nautobotop/crds/clients.yaml diff --git a/go/nautobotop/helm/templates/NOTES.txt b/charts/nautobotop/templates/NOTES.txt similarity index 100% rename from go/nautobotop/helm/templates/NOTES.txt rename to charts/nautobotop/templates/NOTES.txt diff --git a/go/nautobotop/helm/templates/_helpers.tpl b/charts/nautobotop/templates/_helpers.tpl similarity index 100% rename from go/nautobotop/helm/templates/_helpers.tpl rename to charts/nautobotop/templates/_helpers.tpl diff --git a/go/nautobotop/helm/templates/clusterrolebinding.yaml.tpl b/charts/nautobotop/templates/clusterrolebinding.yaml.tpl similarity index 100% rename from go/nautobotop/helm/templates/clusterrolebinding.yaml.tpl rename to charts/nautobotop/templates/clusterrolebinding.yaml.tpl diff --git a/go/nautobotop/helm/templates/clusterroles.yaml.tpl b/charts/nautobotop/templates/clusterroles.yaml.tpl similarity index 100% rename from go/nautobotop/helm/templates/clusterroles.yaml.tpl rename to charts/nautobotop/templates/clusterroles.yaml.tpl diff --git a/go/nautobotop/helm/templates/deployment.yaml.tpl b/charts/nautobotop/templates/deployment.yaml.tpl similarity index 97% rename from go/nautobotop/helm/templates/deployment.yaml.tpl rename to charts/nautobotop/templates/deployment.yaml.tpl index 91187d649..113475373 100644 --- a/go/nautobotop/helm/templates/deployment.yaml.tpl +++ b/charts/nautobotop/templates/deployment.yaml.tpl @@ -38,7 +38,7 @@ spec: securityContext: {{- toYaml . | nindent 12 }} {{- end }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Values.understackRef | default "latest" }}" imagePullPolicy: {{ .Values.image.pullPolicy }} ports: - name: http diff --git a/go/nautobotop/helm/templates/hpa.yaml.tpl b/charts/nautobotop/templates/hpa.yaml.tpl similarity index 100% rename from go/nautobotop/helm/templates/hpa.yaml.tpl rename to charts/nautobotop/templates/hpa.yaml.tpl diff --git a/go/nautobotop/helm/templates/httproute.yaml.tpl b/charts/nautobotop/templates/httproute.yaml.tpl similarity index 100% rename from go/nautobotop/helm/templates/httproute.yaml.tpl rename to charts/nautobotop/templates/httproute.yaml.tpl diff --git a/go/nautobotop/helm/templates/ingress.yaml.tpl b/charts/nautobotop/templates/ingress.yaml.tpl similarity index 100% rename from go/nautobotop/helm/templates/ingress.yaml.tpl rename to charts/nautobotop/templates/ingress.yaml.tpl diff --git a/go/nautobotop/helm/templates/service.yaml.tpl b/charts/nautobotop/templates/service.yaml.tpl similarity index 100% rename from go/nautobotop/helm/templates/service.yaml.tpl rename to charts/nautobotop/templates/service.yaml.tpl diff --git a/go/nautobotop/helm/templates/serviceaccount.yaml.tpl b/charts/nautobotop/templates/serviceaccount.yaml.tpl similarity index 100% rename from go/nautobotop/helm/templates/serviceaccount.yaml.tpl rename to charts/nautobotop/templates/serviceaccount.yaml.tpl diff --git a/go/nautobotop/helm/values.yaml b/charts/nautobotop/values.yaml similarity index 95% rename from go/nautobotop/helm/values.yaml rename to charts/nautobotop/values.yaml index 35de46a4b..d46000538 100644 --- a/go/nautobotop/helm/values.yaml +++ b/charts/nautobotop/values.yaml @@ -10,9 +10,14 @@ image: repository: ghcr.io/rackerlabs/understack/nautobotop # This sets the pull policy for images. pullPolicy: IfNotPresent - # Overrides the image tag whose default is the chart appVersion. + # Pins the image tag. When empty, understackRef is used, then "latest". tag: "" +# Set by the ArgoCD Application to the understack_ref when it is a release tag +# (vX.Y.Z), so the image follows the UnderStack release the chart came from. +# Ignored when image.tag is set. +understackRef: "" + # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ imagePullSecrets: [] # This is to override the chart name. diff --git a/docs/deploy-guide/components/nautobotop.md b/docs/deploy-guide/components/nautobotop.md index c1025cd4a..47367b701 100644 --- a/docs/deploy-guide/components/nautobotop.md +++ b/docs/deploy-guide/components/nautobotop.md @@ -1,6 +1,6 @@ --- charts: -- nautobotop +- charts/nautobotop deploy_overrides: helm: mode: values @@ -16,6 +16,7 @@ Global Nautobot operator deployment driven from the deploy repo. - Cluster scope: global - Values key: `global.nautobotop` +- Helm chart: `charts/nautobotop/` - ArgoCD Application template: `charts/argocd-understack/templates/application-nautobotop.yaml` ## How ArgoCD Builds It diff --git a/docs/operator-guide/nautobotop.md b/docs/operator-guide/nautobotop.md index a888ddd73..533698753 100644 --- a/docs/operator-guide/nautobotop.md +++ b/docs/operator-guide/nautobotop.md @@ -46,7 +46,8 @@ flowchart ### Installation ```bash -helm install nautobotop oci://ghcr.io/rackerlabs/charts/nautobotop:0.0.1 -n nautobotop --create-namespace +helm install nautobotop charts/nautobotop -n nautobotop --create-namespace \ + --set image.tag= ``` ### Basic Configuration @@ -750,7 +751,9 @@ During a sync the operator will create or update objects in Nautobot and remove ## UnderStack Integration -The nautobotop component is defined at `apps/global/nautobotop.yaml` and deployed through ArgoCD. +The nautobotop component is defined by `charts/argocd-understack/templates/application-nautobotop.yaml` +and deployed through ArgoCD. The chart lives in `charts/nautobotop/` and is released with the +repository-wide `vX.Y.Z` tag; the image follows `understack_ref` when it is a release tag and is `latest` otherwise. Pin it in `$DEPLOY_NAME/nautobotop/values.yaml` with `image.tag`. You can customize the deployment per environment: diff --git a/go/nautobotop/.goreleaser.Dockerfile b/go/nautobotop/.goreleaser.Dockerfile deleted file mode 100644 index 149292ea3..000000000 --- a/go/nautobotop/.goreleaser.Dockerfile +++ /dev/null @@ -1,5 +0,0 @@ -# goreleaser is making the binary dynamically linked so can't use the static container -FROM gcr.io/distroless/base-debian12:nonroot -COPY --chmod=555 nautobotop /usr/local/bin/nautobotop -USER 65532:65532 -ENTRYPOINT ["/usr/local/bin/nautobotop"] diff --git a/go/nautobotop/.goreleaser.yaml b/go/nautobotop/.goreleaser.yaml deleted file mode 100644 index 17bf102e4..000000000 --- a/go/nautobotop/.goreleaser.yaml +++ /dev/null @@ -1,95 +0,0 @@ -project_name: "nautobotop" -version: 2 - -before: - hooks: - - go mod tidy - -env: - - CUSTOM_TAG={{ .Env.CUSTOM_TAG }} - - GIT_REPO={{ .Env.GIT_REPO }} - -builds: - - main: main.go - dir: ./cmd - binary: nautobotop - goos: ["linux"] - goarch: ["amd64", "arm64"] - flags: - - -trimpath - ldflags: - - -s - - -w - - -X main.version={{.Version}} - - -X main.commit={{.ShortCommit}} - env: - - CGO_ENABLED=0 - -changelog: - disable: true - -dockers: - - skip_push: false - use: buildx - dockerfile: .goreleaser.Dockerfile - image_templates: - - ghcr.io/{{ .Env.GIT_REPO }}/{{ .ProjectName }}:{{ .Env.CUSTOM_TAG }}-amd64 - build_flag_templates: - - --platform=linux/amd64 - - --label=org.opencontainers.image.version={{ .Env.CUSTOM_TAG }} - - --label=org.opencontainers.image.revision={{ .Commit }} - - --label=org.opencontainers.image.title={{ .ProjectName }} - - --label=org.opencontainers.image.created={{ .Date }} - - --label=org.opencontainers.image.description=Rackspace Cloud DNS support for cert-manager - - --label=org.opencontainers.image.vendor=rackspace - - --label=org.opencontainers.image.licenses=Apache License 2.0 - - --label=org.opencontainers.image.source=https://rackspace.com/ - - --label=org.opencontainers.image.authors=Rackspace - - skip_push: false - goarch: arm64 - use: buildx - dockerfile: .goreleaser.Dockerfile - image_templates: - - ghcr.io/{{ .Env.GIT_REPO }}/{{ .ProjectName }}:{{ .Env.CUSTOM_TAG }}-arm64 - build_flag_templates: - - --platform=linux/arm64 - - --label=org.opencontainers.image.version={{ .Env.CUSTOM_TAG }} - - --label=org.opencontainers.image.revision={{ .Commit }} - - --label=org.opencontainers.image.title={{ .ProjectName }} - - --label=org.opencontainers.image.created={{ .Date }} - - --label=org.opencontainers.image.description=Rackspace Cloud DNS support for cert-manager - - --label=org.opencontainers.image.vendor=rackspace - - --label=org.opencontainers.image.licenses=Apache License 2.0 - - --label=org.opencontainers.image.source=https://rackspace.com/ - - --label=org.opencontainers.image.authors=Rackspace -docker_manifests: - - name_template: ghcr.io/{{ .Env.GIT_REPO }}/{{ .ProjectName }}:{{ .Env.CUSTOM_TAG }} - image_templates: - - ghcr.io/{{ .Env.GIT_REPO }}/{{ .ProjectName }}:{{ .Env.CUSTOM_TAG }}-amd64 - - ghcr.io/{{ .Env.GIT_REPO }}/{{ .ProjectName }}:{{ .Env.CUSTOM_TAG }}-arm64 - - name_template: ghcr.io/{{ .Env.GIT_REPO }}/{{ .ProjectName }}:latest - image_templates: - - ghcr.io/{{ .Env.GIT_REPO }}/{{ .ProjectName }}:{{ .Env.CUSTOM_TAG }}-amd64 - - ghcr.io/{{ .Env.GIT_REPO }}/{{ .ProjectName }}:{{ .Env.CUSTOM_TAG }}-arm64 - - -signs: - - cmd: cosign - signature: "${artifact}.sigstore.json" - output: true - artifacts: checksum - args: - - sign-blob - - "--bundle=${signature}" - - "${artifact}" - - --yes - -docker_signs: - - cmd: cosign - artifacts: manifests - output: true - args: - - "sign" - - "--oidc-provider=github-actions" - - "${artifact}@${digest}" - - --yes diff --git a/go/nautobotop/Makefile b/go/nautobotop/Makefile index 56ac671ed..fd17ca6af 100644 --- a/go/nautobotop/Makefile +++ b/go/nautobotop/Makefile @@ -365,7 +365,7 @@ catalog-push: ## Push a catalog image. $(MAKE) docker-push IMG=$(CATALOG_IMG) .PHONY: copy-crds-to-helm -copy-crds-to-helm: ## Copy generated CRDs into Helm chart +copy-crds-to-helm: ## Copy generated CRDs into the charts/nautobotop Helm chart @echo "Copying CRDs to Helm chart..." - mkdir -p helm/crds - cat config/crd/bases/sync.rax.io_nautobots.yaml > helm/crds/clients.yaml + mkdir -p ../../charts/nautobotop/crds + cat config/crd/bases/sync.rax.io_nautobots.yaml > ../../charts/nautobotop/crds/clients.yaml