Merge pull request #102 from NVIDIA/custom-go-proxy

add support building k8s-driver-manager with custom GOPROXY

Author: tariq1890

.github/workflows/ci.yaml

@@ -35,6 +35,8 @@ jobs:
         run: echo "version=$(echo $GITHUB_SHA | cut -c1-8)" >> "$GITHUB_OUTPUT"
 
   golang:
+    needs: [variables]
+    secrets: inherit
     uses: ./.github/workflows/golang.yaml
 
   image:

.github/workflows/golang.yaml

@@ -16,13 +16,6 @@ name: Golang
 
 on:
   workflow_call: {}
-  pull_request:
-    types:
-      - opened
-      - synchronize
-    branches:
-      - main
-      - release-*
 
 jobs:
   check:
@@ -71,7 +64,7 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version: ${{ env.GOLANG_VERSION }}
-      
+
       - name: Run unit tests and generate coverage report
         run: make coverage
 
@@ -83,7 +76,10 @@ jobs:
 
   build:
     name: Build
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -99,4 +95,19 @@ jobs:
         with:
           go-version: ${{ env.GOLANG_VERSION }}
 
-      - run: make build
+      - name: Setup JFrog CLI
+        id: jfrog
+        uses: jfrog/setup-jfrog-cli@v4
+        env:
+          JF_URL: https://${{ secrets.OIDC_ARTIFACTORY_ENDPOINT }}/
+        with:
+          oidc-provider-name: nvgithub
+          oidc-audience: ${{ secrets.OIDC_ARTIFACTORY_ENDPOINT }}
+      - env:
+          OIDC_USER: ${{ steps.jfrog.outputs.oidc-user }}
+          OIDC_TOKEN: ${{ steps.jfrog.outputs.oidc-token }}
+          OIDC_ARTIFACTORY_ENDPOINT: ${{ secrets.OIDC_ARTIFACTORY_ENDPOINT }}
+        run: |
+          OIDC_USER_ENCODED=$(python3 -c 'import urllib.parse, os; print(urllib.parse.quote_plus(os.environ["OIDC_USER"]))')
+          export GOPROXY="https://${OIDC_USER_ENCODED}:${OIDC_TOKEN}@${OIDC_ARTIFACTORY_ENDPOINT}/artifactory/api/go/edge-go-remote-virtual"
+          make build

.github/workflows/image.yaml

@@ -27,7 +27,11 @@ on:
 
 jobs:
   build-image:
-    runs-on: ubuntu-latest
+    runs-on: linux-amd64-cpu4
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
     strategy:
       matrix:
         dist: [ubi9]
@@ -49,13 +53,25 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-
+      - name: Setup JFrog CLI
+        id: jfrog
+        uses: jfrog/setup-jfrog-cli@v4
+        env:
+          JF_URL: https://${{ secrets.OIDC_ARTIFACTORY_ENDPOINT }}/
+        with:
+          oidc-provider-name: nvgithub
+          oidc-audience: ${{ secrets.OIDC_ARTIFACTORY_ENDPOINT }}
       - name: Build image
         env:
           IMAGE_NAME: ghcr.io/nvidia/k8s-driver-manager
           VERSION: ${{ inputs.version }}
           PUSH_ON_BUILD: "true"
           BUILD_MULTI_ARCH_IMAGES: ${{ inputs.build_multi_arch_images }}
+          OIDC_USER: ${{ steps.jfrog.outputs.oidc-user }}
+          OIDC_TOKEN: ${{ steps.jfrog.outputs.oidc-token }}
+          OIDC_ARTIFACTORY_ENDPOINT: ${{ secrets.OIDC_ARTIFACTORY_ENDPOINT }}
         run: |
+          OIDC_USER_ENCODED=$(python3 -c 'import urllib.parse, os; print(urllib.parse.quote_plus(os.environ["OIDC_USER"]))')
+          export GOPROXY="https://${OIDC_USER_ENCODED}:${OIDC_TOKEN}@${OIDC_ARTIFACTORY_ENDPOINT}/artifactory/api/go/edge-go-remote-virtual"
           echo "${VERSION}"
           make -f deployments/container/Makefile build-${{ matrix.dist }}

deployments/container/Dockerfile.ubi9

@@ -16,6 +16,9 @@ FROM nvcr.io/nvidia/cuda:13.0.1-base-ubi9 AS build
 
 WORKDIR /work
 
+ARG GOPROXY=direct
+ENV GOPROXY=$GOPROXY
+
 COPY go.mod go.mod
 COPY go.sum go.sum
 COPY vendor vendor

deployments/container/Makefile

@@ -27,6 +27,8 @@ REGISTRY ?= nvidia
 IMAGE_NAME := $(REGISTRY)/k8s-driver-manager
 endif
 
+GOPROXY ?= direct
+
 IMAGE_VERSION := $(VERSION)
 
 IMAGE = $(IMAGE_NAME):$(IMAGE_VERSION)
@@ -66,6 +68,7 @@ $(BUILD_TARGETS): build-%:
 			--build-arg VERSION="$(VERSION)" \
 			--build-arg GIT_COMMIT="$(GIT_COMMIT)" \
 			--build-arg CVE_UPDATES="$(CVE_UPDATES)" \
+			--build-arg GOPROXY="$(GOPROXY)" \
 			--file $(DOCKERFILE) \
 			$(CURDIR)