Skip to content

Commit 73f8c57

Browse files
maelvlsmaelvls
committed
running cmrel does not require to be in the release repo folder anymore
The flag --cloudbuild was thus removed. Signed-off-by: Maël Valais <[email protected]>
1 parent 3bd8661 commit 73f8c57

File tree

5 files changed

+166
-29
lines changed

5 files changed

+166
-29
lines changed

‎cmd/cmrel/cmd/publish.go‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ import (
2828

2929
"github.com/cert-manager/release/pkg/gcb"
3030
"github.com/cert-manager/release/pkg/release"
31+
32+
_ "embed"
3133
)
3234

3335
const (
@@ -53,9 +55,6 @@ type publishOptions struct {
5355
// Name of the staged release to publish
5456
ReleaseName string
5557

56-
// The path to the cloudbuild.yaml file used to perform the cert-manager crossbuild
57-
CloudBuildFile string
58-
5958
// Project to run the GCB job in
6059
Project string
6160

@@ -98,8 +97,6 @@ type publishOptions struct {
9897
func (o *publishOptions) AddFlags(fs *flag.FlagSet, markRequired func(string)) {
9998
fs.StringVar(&o.Bucket, "bucket", release.DefaultBucketName, "The name of the GCS bucket to publish the release to.")
10099
fs.StringVar(&o.ReleaseName, "release-name", "", "Name of the staged release to publish.")
101-
fs.StringVar(&o.CloudBuildFile, "cloudbuild", "./gcb/publish/cloudbuild.yaml", "The path to the cloudbuild.yaml file used to publish the release. "+
102-
"The default value assumes that this tool is run from the root of the release repository.")
103100
fs.StringVar(&o.Project, "project", release.DefaultReleaseProject, "The GCP project to run the GCB build jobs in.")
104101
fs.BoolVar(&o.NoMock, "nomock", false, "Whether to actually publish the release. If false, the command will exit after preparing the release for pushing.")
105102
fs.StringVar(&o.PublishedImageRepository, "published-image-repo", release.DefaultImageRepository, "The docker image repository to push the release images & manifest lists to.")
@@ -145,7 +142,10 @@ func publishCmd(rootOpts *rootOptions) *cobra.Command {
145142
return cmd
146143
}
147144

148-
func runPublish(rootOpts *rootOptions, o *publishOptions) error {
145+
//go:embed publish_cloudbuild.yaml
146+
var cloudbuildPublish []byte
147+
148+
func runPublish(_ *rootOptions, o *publishOptions) error {
149149
ctx := context.Background()
150150
gcs, err := storage.NewClient(ctx)
151151
if err != nil {
@@ -159,8 +159,7 @@ func runPublish(rootOpts *rootOptions, o *publishOptions) error {
159159
}
160160
log.Printf("Release with version %q (%s) will be published", rel.Metadata().ReleaseVersion, rel.Metadata().GitCommitRef)
161161

162-
log.Printf("DEBUG: Loading cloudbuild.yaml file from %q", o.CloudBuildFile)
163-
build, err := gcb.LoadBuild(o.CloudBuildFile)
162+
build, err := gcb.LoadCloudBuild(cloudbuildPublish)
164163
if err != nil {
165164
return fmt.Errorf("error loading cloudbuild.yaml file: %w", err)
166165
}

‎cmd/cmrel/cmd/publish_cloudbuild.yaml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
timeout: 14400s
2+
3+
#### SECURITY NOTICE ####
4+
# Google Cloud Build (GCB) supports the usage of secrets for build requests.
5+
# Secrets appear within GCB configs as base64-encoded strings.
6+
# These secrets are GCP Cloud KMS-encrypted and cannot be decrypted by any human or system
7+
# outside of GCP Cloud KMS for the GCP project this encrypted resource was created for.
8+
# Seeing the base64-encoded encrypted blob here is not a security event for the project.
9+
#
10+
# More details on using encrypted resources on Google Cloud Build can be found here:
11+
# https://cloud.google.com/cloud-build/docs/securing-builds/use-encrypted-secrets-credentials
12+
#
13+
# (Please do not remove this security notice.)
14+
secrets:
15+
- kmsKeyName: projects/cert-manager-release/locations/europe-west1/keyRings/cert-manager-release/cryptoKeys/cert-manager-release-secret-key
16+
secretEnv:
17+
GITHUB_TOKEN: CiQAPjqeE0LnlyMJdmLr+laf8RxSKjw/BOv8yiTzdi/RjN9IWh4SUQBQ4fbHZMFt3QlDxBvdU81a6r5LXT0pTTXWOuHQbctSsjc2BZCMROgI2wdRCEyTgj5XJ1YQS0kXaEfIucZrhUlMKsJPXt4ZaZkKtxv4RNPpQg==
18+
DOCKER_CONFIG: CiQAPjqeEyZx+aSgFNoW7KQ4wE4hp/9vbWElifjHJNTI0/71ywMSkwIAUOH2xwTfrn72i6p+Op2PYnjDfwMBcInMEtgKAqiTsaup3R5HeL8BsZGuWxVhCEm5CJJ0Rg3CPdFUx2IVmCfC3j32LkAiMxMpszdHTjWHEyWmxwtBlTJW8NFmoYzxfN4Ox9rYFF66eZ0XVdLz1UejXpqAkGFVzTzQSu4rvNFnAsP5Sj7ZKJpXn+p0ZZW1IdMTD0xzCwZjW9hhcTjyNaCKDJYwl8j6Y/bYeoUMrzDQNk48fzKIBgxEdUTR2OOAI785GWSrkB4Y03oEyrfw8jTd1yAoil2S6p3AGV1FbvFleajSCy3Ov+5gjomjtqCbTx06hVsTcqLHC45WzAWPa/8TsiXh5PPgBbkg+pfBQUTj6i9+WA==
19+
20+
steps:
21+
22+
## Clone & checkout the cert-manager release repository
23+
- name: gcr.io/cloud-builders/go:alpine-1.16
24+
dir: "go/src/github.com/cert-manager/release"
25+
entrypoint: sh
26+
args:
27+
- -c
28+
- |
29+
set -e
30+
git clone "${_RELEASE_REPO_URL}" . && git checkout "${_RELEASE_REPO_REF}"
31+
CGO_ENABLED=0 go build -o /workspace/go/bin/cmrel ./cmd/cmrel
32+
33+
## Write DOCKER_CONFIG file to $HOME/.docker/config.json
34+
- name: gcr.io/cloud-builders/docker:19.03.8
35+
entrypoint: bash
36+
secretEnv:
37+
- DOCKER_CONFIG
38+
args:
39+
- -c
40+
- |
41+
mkdir -p $$HOME/.docker
42+
echo "$${DOCKER_CONFIG}" > $$HOME/.docker/config.json
43+
44+
## Build and push the release artifacts
45+
- name: gcr.io/cloud-builders/docker:19.03.8
46+
dir: "go/src/github.com/jetstack/cert-manager"
47+
entrypoint: /workspace/go/bin/cmrel
48+
secretEnv:
49+
- GITHUB_TOKEN
50+
args:
51+
- gcb
52+
- publish
53+
- --bucket=${_RELEASE_BUCKET}
54+
- --release-name=${_RELEASE_NAME}
55+
- --nomock=${_NO_MOCK}
56+
- --published-github-org=${_PUBLISHED_GITHUB_ORG}
57+
- --published-github-repo=${_PUBLISHED_GITHUB_REPO}
58+
- --published-helm-chart-github-owner=${_PUBLISHED_HELM_CHART_GITHUB_OWNER}
59+
- --published-helm-chart-github-repo=${_PUBLISHED_HELM_CHART_GITHUB_REPO}
60+
- --published-helm-chart-github-branch=${_PUBLISHED_HELM_CHART_GITHUB_BRANCH}
61+
- --published-image-repo=${_PUBLISHED_IMAGE_REPO}
62+
63+
tags:
64+
- "cert-manager-release-publish"
65+
- "name-${_TAG_RELEASE_NAME}"
66+
67+
# Use the --substitutions=_OS=linux,_ARCH=arm64 flag to gcloud build submit to
68+
# override these values
69+
substitutions:
70+
## Required parameters
71+
_RELEASE_NAME: ""
72+
## Optional/defaulted parameters
73+
_RELEASE_BUCKET: ""
74+
## Options controlling the version of the release tooling used in the build.
75+
_RELEASE_REPO_URL: https://github.com/cert-manager/release.git
76+
_RELEASE_REPO_REF: "master"
77+
_NO_MOCK: "false"
78+
_PUBLISHED_GITHUB_ORG: ""
79+
_PUBLISHED_GITHUB_REPO: ""
80+
_PUBLISHED_HELM_CHART_GITHUB_OWNER: ""
81+
_PUBLISHED_HELM_CHART_GITHUB_REPO: ""
82+
_PUBLISHED_HELM_CHART_GITHUB_BRANCH: ""
83+
_PUBLISHED_IMAGE_REPO: ""
84+
## Used as a tag to identify the build more easily later
85+
_TAG_RELEASE_NAME: ""

‎cmd/cmrel/cmd/stage.go‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ import (
2727

2828
"github.com/cert-manager/release/pkg/gcb"
2929
"github.com/cert-manager/release/pkg/release"
30+
31+
_ "embed"
3032
)
3133

3234
const (
@@ -67,9 +69,6 @@ type stageOptions struct {
6769
// Optional commit ref of cert-manager that should be staged
6870
GitRef string
6971

70-
// The path to the cloudbuild.yaml file used to perform the cert-manager crossbuild
71-
CloudBuildFile string
72-
7372
// Project is the name of the GCP project to run the GCB job in
7473
Project string
7574

@@ -92,8 +91,6 @@ func (o *stageOptions) AddFlags(fs *flag.FlagSet, markRequired func(string)) {
9291
fs.StringVar(&o.Repo, "repo", "cert-manager", "Name of the GitHub repo to fetch cert-manager sources from.")
9392
fs.StringVar(&o.Branch, "branch", "master", "The git branch to build the release from. If --git-ref is not specified, the HEAD of this branch will be looked up on GitHub.")
9493
fs.StringVar(&o.GitRef, "git-ref", "", "The git commit ref of cert-manager that should be staged.")
95-
fs.StringVar(&o.CloudBuildFile, "cloudbuild", "./gcb/stage/cloudbuild.yaml", "The path to the cloudbuild.yaml file used to perform the cert-manager crossbuild. "+
96-
"The default value assumes that this tool is run from the root of the release repository.")
9794
fs.StringVar(&o.Project, "project", release.DefaultReleaseProject, "The GCP project to run the GCB build jobs in.")
9895
fs.StringVar(&o.ReleaseVersion, "release-version", "", "Optional release version override used to force the version strings used during the release to a specific value. If not set, build is treated as development build and artifacts staged to 'devel' path.")
9996
fs.StringVar(&o.PublishedImageRepository, "published-image-repo", release.DefaultImageRepository, "The docker image repository set when building the release.")
@@ -107,7 +104,6 @@ func (o *stageOptions) print() {
107104
log.Printf(" Repo: %q", o.Repo)
108105
log.Printf(" Branch: %q", o.Branch)
109106
log.Printf(" GitRef: %q", o.GitRef)
110-
log.Printf(" CloudBuildFile: %q", o.CloudBuildFile)
111107
log.Printf(" Project: %q", o.Project)
112108
log.Printf(" ReleaseVersion: %q", o.ReleaseVersion)
113109
log.Printf(" PublishedImageRepo: %q", o.PublishedImageRepository)
@@ -133,7 +129,10 @@ func stageCmd(rootOpts *rootOptions) *cobra.Command {
133129
return cmd
134130
}
135131

136-
func runStage(rootOpts *rootOptions, o *stageOptions) error {
132+
//go:embed stage_cloudbuild.yaml
133+
var cloudbuildStage []byte
134+
135+
func runStage(_ *rootOptions, o *stageOptions) error {
137136
if o.GitRef == "" {
138137
log.Printf("git-ref flag not specified, looking up git commit ref for %s/%s@%s", o.Org, o.Repo, o.Branch)
139138
ref, err := release.LookupBranchRef(o.Org, o.Repo, o.Branch)
@@ -144,8 +143,7 @@ func runStage(rootOpts *rootOptions, o *stageOptions) error {
144143
}
145144
log.Printf("Staging build for %s/%s@%s", o.Org, o.Repo, o.GitRef)
146145

147-
log.Printf("DEBUG: Loading cloudbuild.yaml file from %q", o.CloudBuildFile)
148-
build, err := gcb.LoadBuild(o.CloudBuildFile)
146+
build, err := gcb.LoadCloudBuild(cloudbuildStage)
149147
if err != nil {
150148
return fmt.Errorf("error loading cloudbuild.yaml file: %w", err)
151149
}

‎cmd/cmrel/cmd/stage_cloudbuild.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
timeout: 14400s
2+
3+
steps:
4+
5+
## Clone & checkout the cert-manager repository
6+
- name: gcr.io/cloud-builders/git
7+
dir: "go/src/github.com/jetstack/cert-manager"
8+
entrypoint: bash
9+
args:
10+
- -c
11+
- |
12+
set -e
13+
git clone "${_CM_REPO}" . && git checkout "${_CM_REF}"
14+
15+
## Clone & checkout the cert-manager release repository
16+
- name: gcr.io/cloud-builders/go:alpine-1.16
17+
dir: "go/src/github.com/cert-manager/release"
18+
entrypoint: sh
19+
args:
20+
- -c
21+
- |
22+
set -e
23+
git clone "${_RELEASE_REPO_URL}" . && git checkout "${_RELEASE_REPO_REF}"
24+
CGO_ENABLED=0 go build -o /workspace/go/bin/cmrel ./cmd/cmrel
25+
26+
## Build and push the release artifacts
27+
- name: 'l.gcr.io/google/bazel:${_BAZEL_VERSION}'
28+
dir: "go/src/github.com/jetstack/cert-manager"
29+
entrypoint: /workspace/go/bin/cmrel
30+
args:
31+
- gcb
32+
- stage
33+
- --repo-path=.
34+
- --release-version=${_RELEASE_VERSION}
35+
- --published-image-repo=${_PUBLISHED_IMAGE_REPO}
36+
- --bucket=${_RELEASE_BUCKET}
37+
38+
tags:
39+
- "cert-manager-release-stage"
40+
- "bazel-${_BAZEL_VERSION}"
41+
- "ref-${_CM_REF}"
42+
- "branch-${_TAG_RELEASE_BRANCH}"
43+
44+
# Use the --substitutions=_OS=linux,_ARCH=arm64 flag to gcloud build submit to
45+
# override these values
46+
substitutions:
47+
## Required parameters
48+
_CM_REF: ""
49+
## Optional/defaulted parameters
50+
_CM_REPO: https://github.com/jetstack/cert-manager.git
51+
_RELEASE_VERSION: ""
52+
_RELEASE_BUCKET: ""
53+
_PUBLISHED_IMAGE_REPO: quay.io/jetstack
54+
_BAZEL_VERSION: "3.5.0"
55+
## Options controlling the version of the release tooling used in the build.
56+
_RELEASE_REPO_URL: https://github.com/cert-manager/release.git
57+
_RELEASE_REPO_REF: "master"
58+
## Used as a tag to identify the build more easily later
59+
_TAG_RELEASE_BRANCH: ""
60+
61+
options:
62+
machineType: n1-highcpu-32

‎pkg/gcb/gcb.go‎

Lines changed: 5 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ import (
2020
"context"
2121
"encoding/json"
2222
"fmt"
23-
"io/ioutil"
2423
"log"
2524
"time"
2625

@@ -34,16 +33,11 @@ const (
3433
Failure = "FAILURE"
3534
)
3635

37-
// LoadBuild will decode a cloudbuild.yaml file into a cloudbuild.Build
38-
// structure and return it.
39-
func LoadBuild(filename string) (*cloudbuild.Build, error) {
40-
f, err := ioutil.ReadFile(filename)
41-
if err != nil {
42-
return nil, err
43-
}
44-
36+
// LoadCloudBuild will decode the content of a cloudbuild.yaml file into a
37+
// cloudbuild.Build structure and return it.
38+
func LoadCloudBuild(cloudbuildRaw []byte) (*cloudbuild.Build, error) {
4539
cb := cloudbuild.Build{}
46-
if err := yaml.UnmarshalStrict(f, &cb); err != nil {
40+
if err := yaml.UnmarshalStrict(cloudbuildRaw, &cb); err != nil {
4741
return nil, err
4842
}
4943

@@ -59,10 +53,9 @@ func SubmitBuild(svc *cloudbuild.Service, projectID string, build *cloudbuild.Bu
5953
return nil, err
6054
}
6155

62-
log.Printf("DEBUG: decoding build operation metadata")
6356
metadata := &cloudbuild.BuildOperationMetadata{}
6457
if err := json.Unmarshal(op.Metadata, metadata); err != nil {
65-
return nil, err
58+
return nil, fmt.Errorf("while decoding build operation metadata: %v", err)
6659
}
6760

6861
return metadata.Build, nil

0 commit comments

Comments
 (0)