Skip to content

Commit 8bb6476

Browse files
dwithdwith
committed
Fix: Manila: manila-share needs its own image
images for each component have been separated anticipating changes. New apt packages added to container for manila-share: nfs-kernel-server openvswitch-switch bridge-utils iproute2
1 parent 6c19bf7 commit 8bb6476

15 files changed

+1362
-3
lines changed

‎.github/workflows/container-build-manila-api.yaml‎

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
---
2+
name: Create and publish a manila-api image
3+
4+
permissions:
5+
actions: read
6+
contents: read
7+
id-token: write
8+
packages: write
9+
pull-requests: write
10+
security-events: write
11+
12+
on:
13+
pull_request:
14+
paths:
15+
- .github/workflows/container-build-manila-api.yaml
16+
- ContainerFiles/manila-api
17+
- scripts/manila-api-cve-patching.sh
18+
schedule:
19+
- cron: '0 0 * * 0' # Run Weekly at midnight UTC
20+
workflow_dispatch:
21+
inputs:
22+
openstack-constraints:
23+
description: 'Version of OpenStack Constraints to use'
24+
required: true
25+
default: "master"
26+
type: choice
27+
options:
28+
- master
29+
- unmaintained/2024.1
30+
- stable/2025.1
31+
project-version:
32+
description: 'Version of OpenStack manila to build, defaults to openstack-constraints if unspecified'
33+
required: false
34+
type: string
35+
36+
env:
37+
REGISTRY: ghcr.io
38+
IMAGE_NAME: ${{ github.repository }}/manila-api
39+
project_version: ${{ github.event.inputs.project-version }}
40+
# NOTE(cloudnull): This is used to parse the workflow_dispatch inputs, sadly the inputs are not available in the
41+
# workflow_dispatch event, so they're being stored in the environment variables. This is a
42+
# workaround until there's a better way to handle this.
43+
openstack_constraints: >
44+
["unmaintained/2024.1", "stable/2025.1"]
45+
46+
jobs:
47+
init:
48+
runs-on: ubuntu-latest
49+
outputs:
50+
openstack-constraints: ${{ steps.generate-matrix.outputs.openstack_constraints }}
51+
steps:
52+
- name: generate-matrix
53+
id: generate-matrix
54+
run: |
55+
if [ "${{ github.event_name == 'workflow_dispatch' }}" = "true" ]; then
56+
openstack_constraints="$(echo '${{ github.event.inputs.openstack-constraints }}' | jq -R '[select(length>0)]' | jq -c '.')"
57+
fi
58+
echo "openstack_constraints=${openstack_constraints:-${{ env.openstack_constraints }}}" >> $GITHUB_OUTPUT
59+
build-and-push-image:
60+
needs:
61+
- init
62+
strategy:
63+
matrix:
64+
openstack-constraints: ${{ fromJSON(needs.init.outputs.openstack-constraints)}}
65+
runs-on: ubuntu-latest
66+
steps:
67+
- name: Checkout
68+
uses: actions/checkout@v4
69+
- name: Set up QEMU
70+
uses: docker/setup-qemu-action@v3
71+
- name: Set up Docker Buildx
72+
uses: docker/setup-buildx-action@v3
73+
- name: Dynamically set MY_DATE environment variable
74+
run: echo "MY_DATE=$(date +%s)" >> $GITHUB_ENV
75+
- name: Dynamically set OS_VERSION_PARSE environment variable
76+
run: |
77+
VERSION=$(echo -n "${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }}" | awk -F'/' '{($2=="" ? x=$1 : x=$2); print x}')
78+
echo "OS_VERSION_PARSE=${VERSION}" >> $GITHUB_ENV
79+
NAME=$(echo -n "${{ env.IMAGE_NAME }}" | awk -F'/' '{print $NF}')
80+
echo "CATEGORY_NAME=${VERSION}-${NAME}" >> $GITHUB_ENV
81+
- name: Log in to the Container registry
82+
uses: docker/login-action@v3
83+
with:
84+
registry: ${{ env.REGISTRY }}
85+
username: ${{ github.actor }}
86+
password: ${{ secrets.GITHUB_TOKEN }}
87+
- name: Extract metadata (tags, labels) for Docker
88+
id: meta
89+
uses: docker/metadata-action@v5
90+
with:
91+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
92+
- name: Build and push Docker image
93+
uses: docker/build-push-action@v6
94+
with:
95+
context: .
96+
file: ContainerFiles/manila-api
97+
push: false
98+
load: true
99+
cache-from: type=gha
100+
cache-to: type=gha,mode=max
101+
tags: |
102+
${{ env.IMAGE_NAME }}:local
103+
labels: ${{ steps.meta.outputs.labels }}
104+
build-args: |
105+
OS_VERSION=${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }}
106+
OS_CONSTRAINTS=${{ matrix.openstack-constraints }}
107+
CACHEBUST=${{ github.sha }}
108+
- name: Run Trivy vulnerability scanner
109+
uses: aquasecurity/[email protected] # using latest trivy scanner
110+
if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
111+
with:
112+
image-ref: '${{ env.IMAGE_NAME }}:local'
113+
format: 'sarif'
114+
output: 'trivy-results.sarif'
115+
ignore-unfixed: true
116+
skip-files: /etc/ssl/private/ssl-cert-snakeoil.key,/usr/local/bin/pip
117+
severity: 'CRITICAL,HIGH,MEDIUM'
118+
- name: Upload Trivy scan results to GitHub Security tab
119+
continue-on-error: true
120+
if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
121+
uses: github/codeql-action/upload-sarif@v3
122+
with:
123+
sarif_file: 'trivy-results.sarif'
124+
category: "${{ env.CATEGORY_NAME }}"
125+
- name: Run Trivy scanner
126+
uses: aquasecurity/[email protected] # using latest trivy scanner
127+
if: ${{ github.event_name == 'pull_request' }}
128+
with:
129+
image-ref: '${{ env.IMAGE_NAME }}:local'
130+
output: trivy.txt
131+
ignore-unfixed: true
132+
skip-files: /etc/ssl/private/ssl-cert-snakeoil.key,/usr/local/bin/pip
133+
severity: 'CRITICAL,HIGH,MEDIUM'
134+
- name: Create trivy output file in markdown format
135+
if: ${{ github.event_name == 'pull_request' }}
136+
run: |
137+
if [[ -s trivy.txt ]]; then
138+
echo "### Security Output" > trivy-output.txt
139+
echo '```terraform' >> trivy-output.txt
140+
cat trivy.txt >> trivy-output.txt
141+
echo '```' >> trivy-output.txt
142+
fi
143+
- name: Publish Trivy Output to Summary
144+
if: ${{ github.event_name == 'pull_request' }}
145+
run: |
146+
if [[ -s trivy-output.txt ]]; then
147+
{
148+
cat trivy-output.txt
149+
} >> $GITHUB_STEP_SUMMARY
150+
fi
151+
- name: Build and push Docker image
152+
uses: docker/build-push-action@v6
153+
with:
154+
context: .
155+
file: ContainerFiles/manila-api
156+
push: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
157+
cache-from: type=gha
158+
cache-to: type=gha,mode=max
159+
tags: |
160+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.OS_VERSION_PARSE }}-latest
161+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.OS_VERSION_PARSE }}-${{ env.MY_DATE }}
162+
labels: ${{ steps.meta.outputs.labels }}
163+
build-args: |
164+
OS_VERSION=${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }}
165+
OS_CONSTRAINTS=${{ matrix.openstack-constraints }}
166+
CACHEBUST=${{ github.sha }}

‎.github/workflows/container-build-manila-data.yaml‎

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
---
2+
name: Create and publish a manila-data image
3+
4+
permissions:
5+
actions: read
6+
contents: read
7+
id-token: write
8+
packages: write
9+
pull-requests: write
10+
security-events: write
11+
12+
on:
13+
pull_request:
14+
paths:
15+
- .github/workflows/container-build-manila-data.yaml
16+
- ContainerFiles/manila-data
17+
- scripts/manila-data-cve-patching.sh
18+
schedule:
19+
- cron: '0 0 * * 0' # Run Weekly at midnight UTC
20+
workflow_dispatch:
21+
inputs:
22+
openstack-constraints:
23+
description: 'Version of OpenStack Constraints to use'
24+
required: true
25+
default: "master"
26+
type: choice
27+
options:
28+
- master
29+
- unmaintained/2024.1
30+
- stable/2025.1
31+
project-version:
32+
description: 'Version of OpenStack manila to build, defaults to openstack-constraints if unspecified'
33+
required: false
34+
type: string
35+
36+
env:
37+
REGISTRY: ghcr.io
38+
IMAGE_NAME: ${{ github.repository }}/manila-data
39+
project_version: ${{ github.event.inputs.project-version }}
40+
# NOTE(cloudnull): This is used to parse the workflow_dispatch inputs, sadly the inputs are not available in the
41+
# workflow_dispatch event, so they're being stored in the environment variables. This is a
42+
# workaround until there's a better way to handle this.
43+
openstack_constraints: >
44+
["unmaintained/2024.1", "stable/2025.1"]
45+
46+
jobs:
47+
init:
48+
runs-on: ubuntu-latest
49+
outputs:
50+
openstack-constraints: ${{ steps.generate-matrix.outputs.openstack_constraints }}
51+
steps:
52+
- name: generate-matrix
53+
id: generate-matrix
54+
run: |
55+
if [ "${{ github.event_name == 'workflow_dispatch' }}" = "true" ]; then
56+
openstack_constraints="$(echo '${{ github.event.inputs.openstack-constraints }}' | jq -R '[select(length>0)]' | jq -c '.')"
57+
fi
58+
echo "openstack_constraints=${openstack_constraints:-${{ env.openstack_constraints }}}" >> $GITHUB_OUTPUT
59+
build-and-push-image:
60+
needs:
61+
- init
62+
strategy:
63+
matrix:
64+
openstack-constraints: ${{ fromJSON(needs.init.outputs.openstack-constraints)}}
65+
runs-on: ubuntu-latest
66+
steps:
67+
- name: Checkout
68+
uses: actions/checkout@v4
69+
- name: Set up QEMU
70+
uses: docker/setup-qemu-action@v3
71+
- name: Set up Docker Buildx
72+
uses: docker/setup-buildx-action@v3
73+
- name: Dynamically set MY_DATE environment variable
74+
run: echo "MY_DATE=$(date +%s)" >> $GITHUB_ENV
75+
- name: Dynamically set OS_VERSION_PARSE environment variable
76+
run: |
77+
VERSION=$(echo -n "${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }}" | awk -F'/' '{($2=="" ? x=$1 : x=$2); print x}')
78+
echo "OS_VERSION_PARSE=${VERSION}" >> $GITHUB_ENV
79+
NAME=$(echo -n "${{ env.IMAGE_NAME }}" | awk -F'/' '{print $NF}')
80+
echo "CATEGORY_NAME=${VERSION}-${NAME}" >> $GITHUB_ENV
81+
- name: Log in to the Container registry
82+
uses: docker/login-action@v3
83+
with:
84+
registry: ${{ env.REGISTRY }}
85+
username: ${{ github.actor }}
86+
password: ${{ secrets.GITHUB_TOKEN }}
87+
- name: Extract metadata (tags, labels) for Docker
88+
id: meta
89+
uses: docker/metadata-action@v5
90+
with:
91+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
92+
- name: Build and push Docker image
93+
uses: docker/build-push-action@v6
94+
with:
95+
context: .
96+
file: ContainerFiles/manila-data
97+
push: false
98+
load: true
99+
cache-from: type=gha
100+
cache-to: type=gha,mode=max
101+
tags: |
102+
${{ env.IMAGE_NAME }}:local
103+
labels: ${{ steps.meta.outputs.labels }}
104+
build-args: |
105+
OS_VERSION=${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }}
106+
OS_CONSTRAINTS=${{ matrix.openstack-constraints }}
107+
CACHEBUST=${{ github.sha }}
108+
- name: Run Trivy vulnerability scanner
109+
uses: aquasecurity/[email protected] # using latest trivy scanner
110+
if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
111+
with:
112+
image-ref: '${{ env.IMAGE_NAME }}:local'
113+
format: 'sarif'
114+
output: 'trivy-results.sarif'
115+
ignore-unfixed: true
116+
skip-files: /etc/ssl/private/ssl-cert-snakeoil.key,/usr/local/bin/pip
117+
severity: 'CRITICAL,HIGH,MEDIUM'
118+
- name: Upload Trivy scan results to GitHub Security tab
119+
continue-on-error: true
120+
if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
121+
uses: github/codeql-action/upload-sarif@v3
122+
with:
123+
sarif_file: 'trivy-results.sarif'
124+
category: "${{ env.CATEGORY_NAME }}"
125+
- name: Run Trivy scanner
126+
uses: aquasecurity/[email protected] # using latest trivy scanner
127+
if: ${{ github.event_name == 'pull_request' }}
128+
with:
129+
image-ref: '${{ env.IMAGE_NAME }}:local'
130+
output: trivy.txt
131+
ignore-unfixed: true
132+
skip-files: /etc/ssl/private/ssl-cert-snakeoil.key,/usr/local/bin/pip
133+
severity: 'CRITICAL,HIGH,MEDIUM'
134+
- name: Create trivy output file in markdown format
135+
if: ${{ github.event_name == 'pull_request' }}
136+
run: |
137+
if [[ -s trivy.txt ]]; then
138+
echo "### Security Output" > trivy-output.txt
139+
echo '```terraform' >> trivy-output.txt
140+
cat trivy.txt >> trivy-output.txt
141+
echo '```' >> trivy-output.txt
142+
fi
143+
- name: Publish Trivy Output to Summary
144+
if: ${{ github.event_name == 'pull_request' }}
145+
run: |
146+
if [[ -s trivy-output.txt ]]; then
147+
{
148+
cat trivy-output.txt
149+
} >> $GITHUB_STEP_SUMMARY
150+
fi
151+
- name: Build and push Docker image
152+
uses: docker/build-push-action@v6
153+
with:
154+
context: .
155+
file: ContainerFiles/manila-data
156+
push: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
157+
cache-from: type=gha
158+
cache-to: type=gha,mode=max
159+
tags: |
160+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.OS_VERSION_PARSE }}-latest
161+
${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.OS_VERSION_PARSE }}-${{ env.MY_DATE }}
162+
labels: ${{ steps.meta.outputs.labels }}
163+
build-args: |
164+
OS_VERSION=${{ env.project_version != '' && env.project_version || matrix.openstack-constraints }}
165+
OS_CONSTRAINTS=${{ matrix.openstack-constraints }}
166+
CACHEBUST=${{ github.sha }}

0 commit comments

Comments
 (0)