Skip to content

Commit 8f1dd80

Browse files
shubhadapaithankarshubhadapaithankar
committed
Add Hive upgrade infrastructure with artifact cache support
- Create ARM template for arolocaldevsvc ACR in dev environment - Add Bicep templates for artifact cache credentials and rules - Add ARM template for AKS to ACR pull role assignment - Update Hive script to use artifact cache ACR with production version f84d11f6765b20de5a6c66998f2114b6855e94e0 - Support configurable registry via HIVE_ACR_REGISTRY environment variable This enables Hive upgrades in v4-eastus, v4-westeurope, and v4-australiaeast using Azure artifact cache to pull from the new Hive repository at quay.io/redhat-services-prod/crt-redhat-acm-tenant/hive-operator/hive Related: ARO-20992
1 parent 2526de2 commit 8f1dd80

File tree

4 files changed

+131
-2
lines changed

4 files changed

+131
-2
lines changed

‎hack/hive/hive-generate-config.sh‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,20 @@ main() {
99
trap "cleanup $tmpdir" EXIT
1010

1111
# This is the commit sha that the image was built from and ensures we use the correct configs for the release
12-
local -r default_commit="8796c4f534"
12+
# Production version as of Nov 5th: f84d11f6765b20de5a6c66998f2114b6855e94e0
13+
local -r default_commit="f84d11f6765b20de5a6c66998f2114b6855e94e0"
1314
local -r hive_image_commit_hash="${1:-$default_commit}"
1415
log "Using hive commit: $hive_image_commit_hash"
1516
# shellcheck disable=SC2034
1617
local -r hive_operator_namespace="hive"
1718

19+
# Hive images are now pulled from ACR using artifact cache rules
20+
# The new Hive repository: quay.io/redhat-services-prod/crt-redhat-acm-tenant/hive-operator/hive
21+
# is mirrored to ACR via artifact cache rules set up on arolocaldevsvc (dev) and arosvcdev (e2e)
22+
# For dev environments, use arolocaldevsvc; for E2E, use arosvcdev
1823
# shellcheck disable=SC2034
19-
local -r hive_image="arointsvc.azurecr.io/redhat-services-prod/crt-redhat-acm-tenant/hive-operator/hive:${hive_image_commit_hash}"
24+
local -r acr_registry="${HIVE_ACR_REGISTRY:-arolocaldevsvc.azurecr.io}"
25+
local -r hive_image="${acr_registry}/redhat-services-prod/crt-redhat-acm-tenant/hive-operator/hive:${hive_image_commit_hash}"
2026

2127

2228
# shellcheck disable=SC2034

‎pkg/deploy/assets/aks-acr-pull-role.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
3+
"contentVersion": "1.0.0.0",
4+
"parameters": {
5+
"aksClusterName": {
6+
"type": "string",
7+
"metadata": {
8+
"description": "Name of the AKS cluster"
9+
}
10+
},
11+
"acrName": {
12+
"type": "string",
13+
"metadata": {
14+
"description": "Name of the ACR to grant pull access to"
15+
}
16+
},
17+
"acrResourceGroup": {
18+
"type": "string",
19+
"defaultValue": "[resourceGroup().name]",
20+
"metadata": {
21+
"description": "Resource group containing the ACR"
22+
}
23+
}
24+
},
25+
"variables": {
26+
"aksClusterId": "[resourceId('Microsoft.ContainerService/managedClusters', parameters('aksClusterName'))]",
27+
"acrResourceId": "[resourceId(parameters('acrResourceGroup'), 'Microsoft.ContainerRegistry/registries', parameters('acrName'))]",
28+
"acrPullRoleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')]",
29+
"roleAssignmentName": "[guid(variables('aksClusterId'), variables('acrResourceId'), variables('acrPullRoleDefinitionId'))]"
30+
},
31+
"resources": [
32+
{
33+
"type": "Microsoft.Authorization/roleAssignments",
34+
"apiVersion": "2022-04-01",
35+
"name": "[variables('roleAssignmentName')]",
36+
"scope": "[variables('acrResourceId')]",
37+
"properties": {
38+
"roleDefinitionId": "[variables('acrPullRoleDefinitionId')]",
39+
"principalId": "[reference(variables('aksClusterId'), '2023-01-01', 'Full').properties.identityProfile.kubeletidentity.objectId]",
40+
"principalType": "ServicePrincipal",
41+
"description": "Allows AKS cluster to pull images from ACR for Hive deployment"
42+
}
43+
}
44+
],
45+
"outputs": {
46+
"roleAssignmentId": {
47+
"type": "string",
48+
"value": "[resourceId('Microsoft.Authorization/roleAssignments', variables('roleAssignmentName'))]"
49+
}
50+
}
51+
}
52+

‎pkg/deploy/assets/artifact-cache-credential-set.bicep‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
// Credential Set for Artifact Cache
2+
// Stores credentials needed to pull from the new Hive repository
3+
4+
@description('Name of the Azure Container Registry')
5+
param acrName string
6+
7+
@description('Name for the credential set')
8+
param credentialSetName string = 'hive-pull-credentials'
9+
10+
@description('Username or client ID for authentication')
11+
@secure()
12+
param username string
13+
14+
@description('Password or client secret for authentication')
15+
@secure()
16+
param password string
17+
18+
resource acr 'Microsoft.ContainerRegistry/registries@2023-01-01-preview' existing = {
19+
name: acrName
20+
}
21+
22+
resource credentialSet 'Microsoft.ContainerRegistry/registries/credentialSets@2023-01-01-preview' = {
23+
parent: acr
24+
name: credentialSetName
25+
properties: {
26+
authCredentials: [
27+
{
28+
name: 'Credential1'
29+
usernameSecretIdentifier: username
30+
passwordSecretIdentifier: password
31+
}
32+
]
33+
loginServer: 'quay.io'
34+
}
35+
}
36+
37+
output credentialSetResourceId string = credentialSet.id
38+
output credentialSetName string = credentialSet.name
39+

‎pkg/deploy/assets/artifact-cache-rules.bicep‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
// Artifact Cache Rules for Hive Images
2+
// Based on https://msazure.visualstudio.com/AzureRedHatOpenShift/_git/sdp-pipelines?path=/classic/global/infra/Templates/artifact-cache.bicep
3+
4+
@description('Name of the Azure Container Registry')
5+
param acrName string
6+
7+
@description('Source repository for Hive images')
8+
param sourceRepository string = 'quay.io/redhat-services-prod/crt-redhat-acm-tenant/hive-operator/hive'
9+
10+
@description('Target repository name in ACR')
11+
param targetRepository string = 'redhat-services-prod/crt-redhat-acm-tenant/hive-operator/hive'
12+
13+
@description('Credential set resource ID for pull authentication')
14+
param credentialSetResourceId string
15+
16+
resource acr 'Microsoft.ContainerRegistry/registries@2023-01-01-preview' existing = {
17+
name: acrName
18+
}
19+
20+
resource cacheRule 'Microsoft.ContainerRegistry/registries/cacheRules@2023-01-01-preview' = {
21+
parent: acr
22+
name: 'hive-cache-rule'
23+
properties: {
24+
sourceRepository: sourceRepository
25+
targetRepository: targetRepository
26+
credentialSetResourceId: credentialSetResourceId
27+
}
28+
}
29+
30+
output cacheRuleName string = cacheRule.name
31+
output cacheRuleId string = cacheRule.id
32+

0 commit comments

Comments
 (0)