Skip to content

Commit caa78fa

Browse files
vombavomba
committed
add workflow
update workflow add default value to workflow inputs update workflow testing default values test run update workflow update pin ansible version ansible ver ansible ver ansible-core ver update workflow update remove custom role (temporary) add azure build step add SP login update azure envs fix typo add cache add key testing azure add gh token fix cache update workflow seperate jobs update update logs remove cahce from azure test update update fix typo add artifact upload update store step update path add store workflow add input add install openstckclient fix fix command add image-builder workflow fix branch name testing sed typo create tag quotes echo fix add docker login update openstack to use container remove checkout change workflow update .dockerignore update workflow add option testing binbash hostname test test try deps testing testing typo test enable kvm add logs env TEST test mount mount change mount change kvm testing upload artifact update mount rw add user mdkir privileged test testing enable azure add elastx store update storing inherit secrets fix naming add safespring store add safespring store change auth safespring verbose change openstack final add sshca role testing enable image builder update builder add sshca role build new image run build add volume testing add docker image add envs final1
1 parent 05b7129 commit caa78fa

File tree

11 files changed

+408
-0
lines changed

11 files changed

+408
-0
lines changed

‎.github/workflows/build-azure-capi-image.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Build Azure CAPI VM image
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
version:
7+
description: Kuberentes version
8+
required: true
9+
type: string
10+
tag:
11+
description: ck8s-capi tag
12+
required: true
13+
type: string
14+
workflow_call:
15+
inputs:
16+
version:
17+
description: Kubernetes version
18+
required: true
19+
type: string
20+
21+
tag:
22+
description: ck8s-capi tag
23+
required: true
24+
type: string
25+
26+
env:
27+
version: ${{ inputs.version }}
28+
tag: ${{ inputs.tag }}
29+
docker_image: "ghcr.io/elastisys/image-builder-amd64:Automate-production-of-CAPI-VM-images-09c9dac9dc61dc069b72ac55e654cbe1a9190911"
30+
31+
defaults:
32+
run:
33+
working-directory: ./images/capi
34+
shell: bash
35+
36+
jobs:
37+
build-image:
38+
runs-on: ubuntu-24.04
39+
steps:
40+
- name: Checkout repo
41+
uses: actions/checkout@v5
42+
43+
- name: replace variables
44+
run: |
45+
package="${version}-1.1"
46+
series="${version%.*}"
47+
48+
sed -r \
49+
-e "s/\\\$KUBERNETES_SERIES/${series}/" \
50+
-e "s/\\\$KUBERNETES_VERSION/${version}/" \
51+
-e "s/\\\$KUBERNETES_DEB_VERSION/${package}/" \
52+
-e "s/\\\$IMAGE_TAG/${tag}/" \
53+
<"template.json" >"kubernetes.json"
54+
55+
- name: build azure image
56+
run: |
57+
image_name="ubuntu-2404-kube-${version%%-*}-ck8s-capi-${tag}"
58+
59+
export SIG_IMAGE_DEFINITION="${image_name}"
60+
export SIG_PUBLISHER="elastisys"
61+
export SIG_OFFER="ck8s-capi"
62+
export SIG_SKU="${image_name}"
63+
64+
docker run -i --rm \
65+
-e PACKER_VAR_FILES -e PACKER_GITHUB_API_TOKEN=${{ secrets.GITHUB_TOKEN }} \
66+
-e SIG_IMAGE_DEFINITION -e SIG_PUBLISHER -e SIG_OFFER -e SIG_SKU \
67+
-e AZURE_SUBSCRIPTION_ID -e AZURE_CLIENT_ID -e AZURE_CLIENT_SECRET -e AZURE_TENANT_ID -e AZURE_LOCATION \
68+
-e RESOURCE_GROUP_NAME -e GALLERY_NAME -e BUILD_RESOURCE_GROUP_NAME \
69+
-v ${{ github.workspace }}/images/capi:/tmp/host \
70+
${{ env.docker_image }} build-azure-sig-ubuntu-2404-gen2
71+
72+
env:
73+
PACKER_VAR_FILES: /tmp/host/kubernetes.json
74+
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID}}
75+
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
76+
AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
77+
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
78+
AZURE_LOCATION: ${{ secrets.AZURE_LOCATION }}
79+
RESOURCE_GROUP_NAME: ${{ secrets.RESOURCE_GROUP_NAME }}
80+
GALLERY_NAME: ${{ secrets.GALLERY_NAME }}
81+
BUILD_RESOURCE_GROUP_NAME: ${{ secrets.RESOURCE_GROUP_NAME }}

‎.github/workflows/build-capi-vm-images.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: Build CAPI VM image with manual input
2+
3+
on:
4+
# push:
5+
6+
workflow_dispatch:
7+
inputs:
8+
version:
9+
description: k8s version
10+
required: true
11+
type: string
12+
default: "1.33.1"
13+
tag:
14+
description: ck8s capi version
15+
required: true
16+
type: string
17+
default: "0.8"
18+
19+
env:
20+
PACKER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
21+
22+
jobs:
23+
build-azure-image:
24+
uses: ./.github/workflows/build-azure-capi-image.yml
25+
with:
26+
version: ${{ inputs.version || '1.33.1' }}
27+
tag: ${{ inputs.tag || '0.8' }}
28+
secrets: inherit
29+
build-openstack-image:
30+
uses: ./.github/workflows/build-openstack-capi-image.yml
31+
with:
32+
version: ${{ inputs.version || '1.33.1' }}
33+
tag: ${{ inputs.tag || '0.8' }}
34+
store-openstack-image-elastx:
35+
uses: ./.github/workflows/store-openstack-capi-image-elastx.yml
36+
needs: build-openstack-image
37+
with:
38+
version: ${{ inputs.version || '1.33.1' }}
39+
tag: ${{ inputs.tag || '0.8' }}
40+
secrets: inherit
41+
# store-openstack-image-safespring:
42+
# uses: ./.github/workflows/store-openstack-capi-image-safespring.yml
43+
# needs: build-openstack-image
44+
# with:
45+
# version: ${{ inputs.version || '1.33.1' }}
46+
# tag: ${{ inputs.tag || '0.8' }}
47+
# secrets: inherit

‎.github/workflows/build-image-builder.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Build CAPI image builder
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
# pull_request:
8+
9+
env:
10+
IMAGE_NAME: image-builder
11+
REGISTRY: ghcr.io/elastisys
12+
13+
jobs:
14+
build-image-builder:
15+
runs-on: ubuntu-24.04
16+
steps:
17+
- uses: actions/checkout@v5
18+
19+
- name: get tag
20+
id: get-tag
21+
run: |
22+
if [ "${{ github.event_name }}" == "pull_request" ]; then
23+
PR_TITLE="${{ github.event.pull_request.title }}"
24+
PR_TAG=$(echo "${PR_TITLE}" | sed -e 's/ /-/g')
25+
echo "TAG=${PR_TAG}-${{ github.sha }}" >> $GITHUB_OUTPUT
26+
else
27+
echo "TAG=${GITHUB_REF##*/}-${{ github.sha }}" >> $GITHUB_OUTPUT
28+
fi
29+
shell: bash
30+
31+
- name: 'Login to GitHub Container Registry'
32+
uses: docker/login-action@v1
33+
with:
34+
registry: ghcr.io
35+
username: ${{github.actor}}
36+
password: ${{secrets.GITHUB_TOKEN}}
37+
38+
- name: run make docker-build
39+
run: make docker-build
40+
env:
41+
TAG: ${{ steps.get-tag.outputs.TAG }}
42+
43+
- name: run make docker-push
44+
run: make docker-push
45+
env:
46+
TAG: ${{ steps.get-tag.outputs.TAG }}

‎.github/workflows/build-openstack-capi-image.yml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
name: Build OpenStack VM CAPI image
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
version:
7+
description: Kubernetes version
8+
required: true
9+
type: string
10+
tag:
11+
description: ck8s-capi tag
12+
required: true
13+
type: string
14+
workflow_call:
15+
inputs:
16+
version:
17+
description: Kubernetes version
18+
required: true
19+
type: string
20+
tag:
21+
description: ck8s-capi tag
22+
required: true
23+
type: string
24+
25+
env:
26+
version: ${{ inputs.version }}
27+
tag: ${{ inputs.tag }}
28+
docker_image: "ghcr.io/elastisys/image-builder-amd64:Automate-production-of-CAPI-VM-images-7461dbd4e9c3a972cf73d93904f1472270e5af99"
29+
30+
defaults:
31+
run:
32+
working-directory: ./images/capi
33+
shell: bash
34+
35+
jobs:
36+
build-image:
37+
runs-on: ubuntu-24.04
38+
39+
steps:
40+
- uses: actions/checkout@v5
41+
42+
- name: Enable KVM
43+
run: |
44+
echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
45+
sudo udevadm control --reload-rules
46+
sudo udevadm trigger --name-match=kvm
47+
48+
- name: replace variables
49+
run: |
50+
package="${version}-1.1"
51+
series="${version%.*}"
52+
53+
sed -r \
54+
-e "s/\\\$KUBERNETES_SERIES/${series}/" \
55+
-e "s/\\\$KUBERNETES_VERSION/${version}/" \
56+
-e "s/\\\$KUBERNETES_DEB_VERSION/${package}/" \
57+
-e "s/\\\$IMAGE_TAG/${tag}/" \
58+
<"template.json" >"kubernetes.json"
59+
60+
- name: add user
61+
run: |
62+
mkdir -p ${{ github.workspace }}/output
63+
sudo useradd -ms /bin/bash imagebuilder
64+
sudo chmod -R 777 ${{ github.workspace }}/output
65+
66+
- name: build openstack image
67+
run: |
68+
docker run --device=/dev/kvm -i --rm \
69+
-e PACKER_VAR_FILES=/tmp/host/kubernetes.json -e PACKER_LOG -e PACKER_GITHUB_API_TOKEN=${{ secrets.GITHUB_TOKEN }} \
70+
-v ${{ github.workspace }}/images/capi:/tmp/host -v ${{ github.workspace }}/output:/home/imagebuilder/output:rw \
71+
${{ env.docker_image }} build-qemu-ubuntu-2404-efi
72+
73+
- name: store openstack image
74+
uses: actions/upload-artifact@v4
75+
with:
76+
name: ubuntu-2404-efi-kube-${{ env.version }}-ck8s-capi-${{ env.tag }}
77+
path: ${{ github.workspace }}/output/ubuntu-2404-efi-kube-${{ env.version }}-ck8s-capi-${{ env.tag }}

‎.github/workflows/store-openstack-capi-image-elastx.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Store OpenStack CAPI image on elastx
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
version:
7+
description: Kubernetes version
8+
required: true
9+
type: string
10+
tag:
11+
description: ck8s-capi tag
12+
required: true
13+
type: string
14+
15+
env:
16+
version: ${{ inputs.version }}
17+
tag: ${{ inputs.tag }}
18+
docker_image: ghcr.io/elastisys/openstack-client:v0.1.0
19+
20+
21+
jobs:
22+
on-success:
23+
runs-on: ubuntu-24.04
24+
25+
steps:
26+
- name: retrieve image
27+
uses: actions/download-artifact@v5
28+
with:
29+
name: ubuntu-2404-efi-kube-${{ env.version }}-ck8s-capi-${{ env.tag }}
30+
31+
- name: store image
32+
env:
33+
OS_APPLICATION_CREDENTIAL_ID: ${{ secrets.ELASTX_APPLICATION_CREDENTIAL_ID }}
34+
OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.ELASTX_APPLICATION_CREDENTIAL_SECRET }}
35+
OS_AUTH_URL: "https://ops.elastx.cloud:5000/v3"
36+
OS_AUTH_TYPE: "v3applicationcredential"
37+
OS_IDENTITY_API_VERSION: "3"
38+
OS_INTERFACE: "public"
39+
OS_REGION_NAME: "se-sto"
40+
run: |
41+
42+
image_create_extra_vars+=('--property' 'hw_firmware_type=uefi' '--property' 'hw_disk_bus=scsi' '--property' 'hw_scsi_model=virtio-scsi')
43+
image_name=ubuntu-2404-efi-kube-${{ env.version }}-ck8s-capi-${{ env.tag }}
44+
image_path=/tmp/home/ubuntu-2404-efi-kube-${{ env.version }}-ck8s-capi-${{ env.tag }}
45+
46+
docker run -i --rm \
47+
-e OS_APPLICATION_CREDENTIAL_ID -e OS_APPLICATION_CREDENTIAL_SECRET -e OS_AUTH_URL -e OS_AUTH_TYPE -e OS_IDENTITY_API_VERSION -e OS_INTERFACE -e OS_REGION_NAME \
48+
-v ${{ github.workspace }}:/tmp/home ${{ env.docker_image }} \
49+
openstack image create --disk-format qcow2 "${image_create_extra_vars[@]}" --file "${image_path}" --shared --progress "${image_name}"

‎.github/workflows/store-openstack-capi-image-safespring.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: Store OpenStack CAPI image on safespring
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
version:
7+
description: Kubernetes version
8+
required: true
9+
type: string
10+
tag:
11+
description: ck8s-capi tag
12+
required: true
13+
type: string
14+
15+
env:
16+
version: ${{ inputs.version }}
17+
tag: ${{ inputs.tag }}
18+
19+
20+
jobs:
21+
on-success:
22+
runs-on: ubuntu-24.04
23+
24+
steps:
25+
- name: retrieve image
26+
uses: actions/download-artifact@v5
27+
with:
28+
name: ubuntu-2404-efi-kube-${{ env.version }}-ck8s-capi-${{ env.tag }}
29+
30+
- name: install deps
31+
run: |
32+
pip3 install python-openstackclient
33+
34+
- name: store image
35+
env:
36+
OS_APPLICATION_CREDENTIAL_ID: ${{ secrets.SAFESPRING_APPLICATION_CREDENTIAL_ID }}
37+
OS_APPLICATION_CREDENTIAL_SECRET: ${{ secrets.SAFESPRING_APPLICATION_CREDENTIAL_SECRET }}
38+
OS_AUTH_URL: "https://v2.dashboard.sto1.safedc.net:5000/v3/"
39+
OS_AUTH_TYPE: "v3applicationcredential"
40+
OS_IDENTITY_API_VERSION: "3"
41+
OS_INTERFACE: "public"
42+
OS_REGION_NAME: "sto1"
43+
run: |
44+
45+
image_create_extra_vars+=('--property' 'hw_firmware_type=uefi' '--property' 'hw_disk_bus=scsi' '--property' 'hw_scsi_model=virtio-scsi')
46+
image_name=ubuntu-2404-efi-kube-${{ env.version }}-ck8s-capi-${{ env.tag }}
47+
image_path=./ubuntu-2404-efi-kube-${{ env.version }}-ck8s-capi-${{ env.tag }}
48+
49+
openstack image create --verbose --disk-format qcow2 "${image_create_extra_vars[@]}" --file "${image_path}" --shared --progress "${image_name}"
50+

‎images/capi/.dockerignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,4 @@
99
!packer
1010
!Makefile
1111
!azure_targets.sh
12+
!template.json

‎images/capi/Dockerfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ COPY --chown=imagebuilder:imagebuilder hack hack/
5555
COPY --chown=imagebuilder:imagebuilder packer packer/
5656
COPY --chown=imagebuilder:imagebuilder Makefile Makefile
5757
COPY --chown=imagebuilder:imagebuilder azure_targets.sh azure_targets.sh
58+
COPY --chown=imagebuilder:imagebuilder template.json template.json
5859

5960
ENV PATH="/home/imagebuilder/.local/bin:${PATH}"
6061
ENV PACKER_ARGS=''

‎images/capi/ansible/roles/sshca/files/ssh_ca.pub‎

Whitespace-only changes.

‎images/capi/ansible/roles/sshca/tasks/main.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
- name: add the ssh ca public key
2+
ansible.builtin.copy:
3+
dest: /etc/ssh/ssh_ca.pub
4+
mode: "644"
5+
src: ssh_ca.pub
6+
- name: set authorized principals
7+
ansible.builtin.copy:
8+
dest: /etc/ssh/authorized_principals
9+
# Couldn't get this to use the `ssh_username` variable
10+
content: |
11+
ubuntu
12+
- name: add ssh ca settings
13+
ansible.builtin.copy:
14+
dest: /etc/ssh/sshd_config.d/ca.conf
15+
content: |
16+
TrustedUserCAKeys /etc/ssh/ssh_ca.pub
17+
AuthorizedPrincipalsFile /etc/ssh/authorized_principals
18+

0 commit comments

Comments
 (0)