Skip to content

Commit 2df6dea

Browse files
aroberts87aroberts87
committed
ci(rh-shield-operator): enhance operator release pipeline
The old pipeline would simply build and push the operator and bundle images. This was a start, but left numerous manual steps to get the Operator itself certified. The changes in this PR add the following enhancements to the pipeline. 1. Generate the Bundle content in the pipeline a. Run the 'make bundle' command in the pipeline as opposed to requiring it be run beforehand. b. Since the pipeline guarantees the operator image itself will be built and pushed before the bundle is generated, we can set USE_IMAGE_DIGESTS=true when running 'make bundle' to include the image checksums in the bundle. This is a requirement for certification. c. The newly generated bundle content will be modified to include the annotations required for certification that are not created by the operator-sdk. 2. Trigger preflight certification The act of certifying the operator will still require manual intervention.
1 parent cc4dfaf commit 2df6dea

File tree

1 file changed

+135
-15
lines changed

1 file changed

+135
-15
lines changed

‎.github/workflows/release-rh-shield-operator.yaml‎

Lines changed: 135 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,37 @@
1-
name: Release the Shield Operator
1+
name: Build and Push the Shield Operator
22

33
on:
4-
workflow_dispatch:
5-
inputs:
6-
release_version:
7-
description: 'The version of the operator to release'
8-
required: true
9-
type: string
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- 'rh-shield-operator/Makefile' # Updated by the release pipelines
9+
1010
jobs:
11-
build-and-push:
12-
name: Build and Push the Operator Images
11+
determine-operator-version:
12+
name: Determine the Operator Version
13+
runs-on: ubuntu-latest
14+
outputs:
15+
release_version: ${{ steps.get-operator-version.outputs.release_version }}
16+
steps:
17+
- name: Checkout charts repo
18+
uses: actions/checkout@v4
19+
with:
20+
fetch-depth: '1'
21+
22+
- name: Get Operator Version
23+
id: get-operator-version
24+
run: |
25+
VERSION=$(awk '/^VERSION/{print $3}' Makefile)
26+
echo "Discovered release version is $VERSION"
27+
echo "release_version=$VERSION" >> $GITHUB_OUTPUT
28+
working-directory: rh-shield-operator
29+
30+
build-operator:
31+
name: Build the Operator Image
1332
runs-on: ubuntu-latest
1433
steps:
15-
- name: Checkout
34+
- name: Checkout charts repo
1635
uses: actions/checkout@v4
1736
with:
1837
fetch-depth: '1'
@@ -24,10 +43,111 @@ jobs:
2443
username: ${{ secrets.QUAY_RH_SHIELD_OPERATOR_USERNAME }}
2544
password: ${{ secrets.QUAY_RH_SHIELD_OPERATOR_PASSWORD }}
2645

27-
- name: Build and Push Operator and Bundle Images
28-
env:
29-
IMAGE_TAG_BASE: ${{ secrets.QUAY_RH_SHIELD_OPERATOR_IMAGE_TAG_BASE }}
30-
VERSION: ${{ github.event.inputs.release_version }}
46+
- name: Build and Push Operator Image
47+
id: build-operator
3148
run: |
32-
make docker-build docker-push bundle-build bundle-push
49+
make docker-build docker-push
50+
working-directory: rh-shield-operator
51+
52+
build-operator-bundle:
53+
name: Build the Operator Bundle
54+
runs-on: ubuntu-latest
55+
needs:
56+
- build-operator
57+
- determine-operator-version
58+
steps:
59+
- name: Checkout charts repo
60+
uses: actions/checkout@v4
61+
with:
62+
fetch-depth: '1'
63+
64+
- name: Login to Docker registry
65+
uses: docker/login-action@v3
66+
with:
67+
registry: quay.io
68+
username: ${{ secrets.QUAY_RH_SHIELD_OPERATOR_USERNAME }}
69+
password: ${{ secrets.QUAY_RH_SHIELD_OPERATOR_PASSWORD }}
70+
71+
- name: Generate Bundle Content
72+
# When using 'USE_IMAGE_DIGEST', the 'make bundle' command inspects the live operator image from the registry
73+
# to generate the image digest. As a result, this step must be after the operator image has been
74+
# generated and pushed to the registry.
75+
run: |
76+
USE_IMAGE_DIGESTS=true make bundle
77+
working-directory: rh-shield-operator
78+
79+
- name: Set Labels and Annotations required for Certification on the Bundle
80+
uses: mikefarah/yq@v4
81+
with:
82+
cmd: |
83+
yq e -i '.metadata.name |= sub("rh-shield-operator", "sysdig-shield-operator")' rh-shield-operator/bundle/manifests/rh-shield-operator.clusterserviceversion.yaml
84+
yq e -i '.annotations."operators.operatorframework.io.bundle.package.v1" |= sub("rh-shield-operator", "sysdig-shield-operator")' rh-shield-operator/bundle/metadata/annotations.yaml
85+
yq e -i '.metadata.annotations.containerImage = (.spec.relatedImages[] | select(.name == "manager").image)' rh-shield-operator/bundle/manifests/rh-shield-operator.clusterserviceversion.yaml
86+
yq e -i '.metadata.annotations += {
87+
"features.operators.openshift.io/cnf": "false",
88+
"features.operators.openshift.io/cni": "false",
89+
"features.operators.openshift.io/csi": "false",
90+
"features.operators.openshift.io/disconnected": "false",
91+
"features.operators.openshift.io/fips-compliant": "false",
92+
"features.operators.openshift.io/proxy-aware": "false",
93+
"features.operators.openshift.io/tls-profiles": "false",
94+
"features.operators.openshift.io/token-auth-aws": "false",
95+
"features.operators.openshift.io/token-auth-azure": "false",
96+
"features.operators.openshift.io/token-auth-gcp": "false"
97+
}' rh-shield-operator/bundle/manifests/rh-shield-operator.clusterserviceversion.yaml
98+
yq e -i '.annotations."com.redhat.openshift.versions" = "v4.8-v4.17"' rh-shield-operator/bundle/metadata/annotations.yaml
99+
100+
- name: Open Pull Request for Bundle update
101+
uses: peter-evans/create-pull-request@v7
102+
id: open-pr
103+
with:
104+
token: ${{ secrets.TOOLS_JENKINS_ADMIN_ACCESS_GITHUB_TOKEN }}
105+
commit-message: |
106+
"chore(rh-shield-operator): update bundle for rh-shield-operator:v${{ steps.determine-operator-version.outputs.release_version }}"
107+
title: |
108+
"chore(rh-shield-operator): update bundle for rh-shield-operator:v${{ steps.determine-operator-version.outputs.release_version }}"
109+
body: |
110+
This is an automated pull request that is generated as a part of the rh-shield-operator release pipeline.
111+
The changes here update the bundle metadata using the newly published Operator image to generate the
112+
image checksum, as well as adjusting some metadata that is required for certification.
113+
114+
- name: Wait for Pull Request to be merged
115+
uses: Wandalen/[email protected]
116+
with:
117+
command: gh pr view ${{ steps.open-pr.outputs.pull-request-number }} --json state -q .state | grep MERGED
118+
attempt_limit: 240 # Results in 2 hours of waiting
119+
attempt_delay: 30000 # 30 seconds
120+
121+
- name: Build and Push Bundle Image
122+
run: |
123+
make bundle-build bundle-push
124+
working-directory: rh-shield-operator
125+
126+
certify-operator-image:
127+
name: Certify the Operator Image with Preflight
128+
runs-on: ubuntu-latest
129+
needs:
130+
- build-operator
131+
- determine-operator-version
132+
steps:
133+
- name: Checkout charts repo
134+
uses: actions/checkout@v4
135+
with:
136+
fetch-depth: '1'
137+
138+
- name: Install Preflight
139+
uses: redhat-actions/openshift-tools-installer@v1
140+
with:
141+
source: "github"
142+
preflight: "latest"
143+
github_pat: ${{ secrets.GITHUB_TOKEN }}
144+
145+
- name: Run Preflight checks
146+
run: |
147+
IMAGE_TAG_BASE=$(awk '/^IMAGE_TAG_BASE/{print $3}' Makefile)
148+
149+
preflight check container \
150+
$IMAGE_TAG_BASE:v${{ needs.determine-operator-version.outputs.release_version }} \
151+
--pyxis-api-token ${{ secrets.RH_SHIELD_OPERATOR_PYXIS_API_TOKEN }} \
152+
--certification-project-id ${{ secrets.RH_SHIELD_OPERATOR_CERTIFICATION_PROJECT_ID }}
33153
working-directory: rh-shield-operator

0 commit comments

Comments
 (0)