Skip to content

Commit 019c3ea

Browse files
shubhadapaithankarshubhadapaithankar
committed
Add Hive upgrade infrastructure with artifact cache support
- Create ARM template for arolocaldevsvc ACR in dev environment - Add Bicep templates for artifact cache credentials and rules - Add ARM template for AKS to ACR pull role assignment - Update Hive script to use artifact cache ACR with production version f84d11f6765b20de5a6c66998f2114b6855e94e0 - Support configurable registry via HIVE_ACR_REGISTRY environment variable This enables Hive upgrades in v4-eastus, v4-westeurope, and v4-australiaeast using Azure artifact cache to pull from the new Hive repository at quay.io/redhat-services-prod/crt-redhat-acm-tenant/hive-operator/hive Related: ARO-20992
1 parent f7ba248 commit 019c3ea

File tree

5 files changed

+178
-4
lines changed

5 files changed

+178
-4
lines changed

‎hack/hive/hive-generate-config.sh‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,16 +9,20 @@ main() {
99
trap "cleanup $tmpdir" EXIT
1010

1111
# This is the commit sha that the image was built from and ensures we use the correct configs for the release
12-
local -r default_commit="8796c4f534"
12+
# Production version as of Nov 5th: f84d11f6765b20de5a6c66998f2114b6855e94e0
13+
local -r default_commit="f84d11f6765b20de5a6c66998f2114b6855e94e0"
1314
local -r hive_image_commit_hash="${1:-$default_commit}"
1415
log "Using hive commit: $hive_image_commit_hash"
1516
# shellcheck disable=SC2034
1617
local -r hive_operator_namespace="hive"
1718

18-
# For now we'll use the quay hive image, but this will change to an ACR once the quay.io -> ACR mirroring is setup
19-
# Note: semi-scientific way to get the latest image: `podman search --list-tags --limit 10000 quay.io/app-sre/hive | tail -n1`
19+
# Hive images are now pulled from ACR using artifact cache rules
20+
# The new Hive repository: quay.io/redhat-services-prod/crt-redhat-acm-tenant/hive-operator/hive
21+
# is mirrored to ACR via artifact cache rules set up on arolocaldevsvc (dev) and arosvcdev (e2e)
22+
# For dev environments, use arolocaldevsvc; for E2E, use arosvcdev
2023
# shellcheck disable=SC2034
21-
local -r hive_image="arointsvc.azurecr.io/app-sre/hive:${hive_image_commit_hash}"
24+
local -r acr_registry="${HIVE_ACR_REGISTRY:-arolocaldevsvc.azurecr.io}"
25+
local -r hive_image="${acr_registry}/redhat-services-prod/crt-redhat-acm-tenant/hive-operator/hive:${hive_image_commit_hash}"
2226

2327

2428
# shellcheck disable=SC2034

‎pkg/deploy/assets/aks-acr-pull-role.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
3+
"contentVersion": "1.0.0.0",
4+
"parameters": {
5+
"aksClusterName": {
6+
"type": "string",
7+
"metadata": {
8+
"description": "Name of the AKS cluster"
9+
}
10+
},
11+
"acrName": {
12+
"type": "string",
13+
"metadata": {
14+
"description": "Name of the ACR to grant pull access to"
15+
}
16+
},
17+
"acrResourceGroup": {
18+
"type": "string",
19+
"defaultValue": "[resourceGroup().name]",
20+
"metadata": {
21+
"description": "Resource group containing the ACR"
22+
}
23+
}
24+
},
25+
"variables": {
26+
"aksClusterId": "[resourceId('Microsoft.ContainerService/managedClusters', parameters('aksClusterName'))]",
27+
"acrResourceId": "[resourceId(parameters('acrResourceGroup'), 'Microsoft.ContainerRegistry/registries', parameters('acrName'))]",
28+
"acrPullRoleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')]",
29+
"roleAssignmentName": "[guid(variables('aksClusterId'), variables('acrResourceId'), variables('acrPullRoleDefinitionId'))]"
30+
},
31+
"resources": [
32+
{
33+
"type": "Microsoft.Authorization/roleAssignments",
34+
"apiVersion": "2022-04-01",
35+
"name": "[variables('roleAssignmentName')]",
36+
"scope": "[variables('acrResourceId')]",
37+
"properties": {
38+
"roleDefinitionId": "[variables('acrPullRoleDefinitionId')]",
39+
"principalId": "[reference(variables('aksClusterId'), '2023-01-01', 'Full').properties.identityProfile.kubeletidentity.objectId]",
40+
"principalType": "ServicePrincipal",
41+
"description": "Allows AKS cluster to pull images from ACR for Hive deployment"
42+
}
43+
}
44+
],
45+
"outputs": {
46+
"roleAssignmentId": {
47+
"type": "string",
48+
"value": "[resourceId('Microsoft.Authorization/roleAssignments', variables('roleAssignmentName'))]"
49+
}
50+
}
51+
}
52+

‎pkg/deploy/assets/artifact-cache-credential-set.bicep‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
// Credential Set for Artifact Cache
2+
// Stores credentials needed to pull from the new Hive repository
3+
4+
@description('Name of the Azure Container Registry')
5+
param acrName string
6+
7+
@description('Name for the credential set')
8+
param credentialSetName string = 'hive-pull-credentials'
9+
10+
@description('Username or client ID for authentication')
11+
@secure()
12+
param username string
13+
14+
@description('Password or client secret for authentication')
15+
@secure()
16+
param password string
17+
18+
resource acr 'Microsoft.ContainerRegistry/registries@2023-01-01-preview' existing = {
19+
name: acrName
20+
}
21+
22+
resource credentialSet 'Microsoft.ContainerRegistry/registries/credentialSets@2023-01-01-preview' = {
23+
parent: acr
24+
name: credentialSetName
25+
properties: {
26+
authCredentials: [
27+
{
28+
name: 'Credential1'
29+
usernameSecretIdentifier: username
30+
passwordSecretIdentifier: password
31+
}
32+
]
33+
loginServer: 'quay.io'
34+
}
35+
}
36+
37+
output credentialSetResourceId string = credentialSet.id
38+
output credentialSetName string = credentialSet.name
39+

‎pkg/deploy/assets/artifact-cache-rules.bicep‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
// Artifact Cache Rules for Hive Images
2+
// Based on https://msazure.visualstudio.com/AzureRedHatOpenShift/_git/sdp-pipelines?path=/classic/global/infra/Templates/artifact-cache.bicep
3+
4+
@description('Name of the Azure Container Registry')
5+
param acrName string
6+
7+
@description('Source repository for Hive images')
8+
param sourceRepository string = 'quay.io/redhat-services-prod/crt-redhat-acm-tenant/hive-operator/hive'
9+
10+
@description('Target repository name in ACR')
11+
param targetRepository string = 'redhat-services-prod/crt-redhat-acm-tenant/hive-operator/hive'
12+
13+
@description('Credential set resource ID for pull authentication')
14+
param credentialSetResourceId string
15+
16+
resource acr 'Microsoft.ContainerRegistry/registries@2023-01-01-preview' existing = {
17+
name: acrName
18+
}
19+
20+
resource cacheRule 'Microsoft.ContainerRegistry/registries/cacheRules@2023-01-01-preview' = {
21+
parent: acr
22+
name: 'hive-cache-rule'
23+
properties: {
24+
sourceRepository: sourceRepository
25+
targetRepository: targetRepository
26+
credentialSetResourceId: credentialSetResourceId
27+
}
28+
}
29+
30+
output cacheRuleName string = cacheRule.name
31+
output cacheRuleId string = cacheRule.id
32+

‎pkg/deploy/assets/local-dev-acr.json‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
3+
"contentVersion": "1.0.0.0",
4+
"parameters": {
5+
"acrLocationOverride": {
6+
"type": "string",
7+
"defaultValue": "eastus",
8+
"metadata": {
9+
"description": "Location for the ACR if different from resource group"
10+
}
11+
},
12+
"acrName": {
13+
"type": "string",
14+
"defaultValue": "arolocaldevsvc",
15+
"metadata": {
16+
"description": "Name of the Azure Container Registry"
17+
}
18+
}
19+
},
20+
"resources": [
21+
{
22+
"sku": {
23+
"name": "Premium"
24+
},
25+
"properties": {
26+
"dataEndpointEnabled": true,
27+
"anonymousPullEnabled": false,
28+
"networkRuleBypassOptions": "AzureServices"
29+
},
30+
"name": "[parameters('acrName')]",
31+
"type": "Microsoft.ContainerRegistry/registries",
32+
"location": "[if(equals(parameters('acrLocationOverride'), ''), resourceGroup().location, parameters('acrLocationOverride'))]",
33+
"apiVersion": "2023-01-01-preview"
34+
}
35+
],
36+
"outputs": {
37+
"acrLoginServer": {
38+
"type": "string",
39+
"value": "[reference(resourceId('Microsoft.ContainerRegistry/registries', parameters('acrName'))).loginServer]"
40+
},
41+
"acrResourceId": {
42+
"type": "string",
43+
"value": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('acrName'))]"
44+
}
45+
}
46+
}
47+

0 commit comments

Comments
 (0)