Skip to content

Commit 1b75dfb

Browse files
savitaashturechmouel
savitaashture
authored and
chmouel
committed
Add changes for onboarding PAC to Konflux
This PR integrates PAC into Konflux, an open-source, cloud-native software factory that prioritizes software supply chain security.By leveraging Konflux, PAC can now be built and released with enhanced security and consistency. Konflux ensures all images are built hermetically, prefetching dependencies in advance to eliminate runtime internet downloads. Additionally, it enforces policy checks to verify that all preconditions are satisfied, reinforcing compliance and reliability during the build process. Signed-off-by: savitaashture <[email protected]>
1 parent eb50fac commit 1b75dfb

10 files changed

+802
-0
lines changed

‎.konflux/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# konflux-ci manifests
2+
3+
This folder contains [konflux-ci](https://konflux-ci.dev/) configuration that is synced with the konflux-ci cluster.

‎.konflux/dockerfiles/.placeholder

Whitespace-only changes.

‎.konflux/dockerfiles/cli.Dockerfile

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
ARG GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.22
2+
ARG RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:c0e70387664f30cd9cf2795b547e4a9a51002c44a4a86aa9335ab030134bf392
3+
4+
FROM $GO_BUILDER AS builder
5+
6+
ARG TKN_PAC_VERSION=nightly
7+
WORKDIR /go/src/github.com/openshift-pipelines/pipelines-as-code
8+
COPY . .
9+
RUN set -e; for f in patches/*.patch; do echo ${f}; [[ -f ${f} ]] || continue; git apply ${f}; done
10+
ENV GODEBUG="http2server=0"
11+
RUN go build -mod=vendor -tags disable_gcp -v \
12+
-ldflags "-X github.com/openshift-pipelines/pipelines-as-code/pkg/params/version.Version=${TKN_PAC_VERSION}" \
13+
-o /tmp/tkn-pac ./cmd/tkn-pac
14+
15+
FROM $RUNTIME
16+
ARG VERSION=pipelines-as-code-cli-main
17+
18+
COPY --from=builder /tmp/tkn-pac /usr/bin
19+
20+
LABEL \
21+
com.redhat.component="openshift-pipelines-cli-tkn-pac-container" \
22+
name="openshift-pipelines/pipelines-cli-tkn-pac-rhel8" \
23+
version=$VERSION \
24+
summary="Red Hat OpenShift pipelines tkn pac CLI" \
25+
maintainer="[email protected]" \
26+
description="CLI client 'tkn-pac' for managing openshift pipelines" \
27+
io.k8s.display-name="Red Hat OpenShift Pipelines tkn pac CLI" \
28+
io.k8s.description="Red Hat OpenShift Pipelines tkn pac CLI" \
29+
io.openshift.tags="pipelines,tekton,openshift"
30+
31+
RUN microdnf install -y shadow-utils
32+
RUN groupadd -r -g 65532 nonroot && useradd --no-log-init -r -u 65532 -g nonroot nonroot
33+
USER 65532

‎.konflux/dockerfiles/controller.Dockerfile

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
ARG GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.22
2+
ARG RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:c0e70387664f30cd9cf2795b547e4a9a51002c44a4a86aa9335ab030134bf392
3+
4+
FROM $GO_BUILDER AS builder
5+
6+
WORKDIR /go/src/github.com/openshift-pipelines/pipelines-as-code
7+
COPY . .
8+
RUN set -e; for f in patches/*.patch; do echo ${f}; [[ -f ${f} ]] || continue; git apply ${f}; done
9+
ENV GODEBUG="http2server=0"
10+
RUN git rev-parse HEAD > /tmp/HEAD
11+
RUN go build -ldflags="-s -w" -mod=vendor -tags disable_gcp -v -o /tmp/pipelines-as-code-controller \
12+
./cmd/pipelines-as-code-controller
13+
14+
FROM $RUNTIME
15+
ARG VERSION=pipelines-as-code-controller-main
16+
17+
ENV KO_APP=/ko-app \
18+
KO_DATA_PATH=/kodata
19+
20+
COPY --from=builder /tmp/pipelines-as-code-controller ${KO_APP}/pipelines-as-code-controller
21+
COPY --from=builder /tmp/HEAD ${KO_DATA_PATH}/HEAD
22+
23+
LABEL \
24+
com.redhat.component="openshift-pipelines-pipelines-as-code-controller-container" \
25+
name="openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8" \
26+
version=$VERSION \
27+
summary="Red Hat OpenShift Pipelines Pipelines as Code Controller" \
28+
maintainer="[email protected]" \
29+
description="Red Hat OpenShift Pipelines Pipelines as Code Controller" \
30+
io.k8s.display-name="Red Hat OpenShift Pipelines Pipelines as Code Controller" \
31+
io.k8s.description="Red Hat OpenShift Pipelines Pipelines as Code Controller" \
32+
io.openshift.tags="pipelines,tekton,openshift"
33+
34+
RUN microdnf install -y shadow-utils
35+
RUN groupadd -r -g 65532 nonroot && useradd --no-log-init -r -u 65532 -g nonroot nonroot
36+
USER 65532
37+
38+
ENTRYPOINT ["/ko-app/pipelines-as-code-controller"]

‎.konflux/dockerfiles/watcher.Dockerfile

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
ARG GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.22
2+
ARG RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:c0e70387664f30cd9cf2795b547e4a9a51002c44a4a86aa9335ab030134bf392
3+
4+
FROM $GO_BUILDER AS builder
5+
6+
WORKDIR /go/src/github.com/openshift-pipelines/pipelines-as-code
7+
COPY . .
8+
RUN set -e; for f in patches/*.patch; do echo ${f}; [[ -f ${f} ]] || continue; git apply ${f}; done
9+
ENV GODEBUG="http2server=0"
10+
RUN git rev-parse HEAD > /tmp/HEAD
11+
RUN go build -ldflags="-s -w" -mod=vendor -tags disable_gcp -v -o /tmp/pipelines-as-code-watcher \
12+
./cmd/pipelines-as-code-watcher
13+
14+
FROM $RUNTIME
15+
ARG VERSION=pipelines-as-code-watcher-main
16+
17+
ENV KO_APP=/ko-app \
18+
KO_DATA_PATH=/kodata
19+
20+
COPY --from=builder /tmp/pipelines-as-code-watcher ${KO_APP}/pipelines-as-code-watcher
21+
COPY --from=builder /tmp/HEAD ${KO_DATA_PATH}/HEAD
22+
23+
LABEL \
24+
com.redhat.component="openshift-pipelines-pipelines-as-code-watcher-container" \
25+
name="openshift-pipelines/pipelines-as-code-watcher-rhel8" \
26+
version=$VERSION \
27+
summary="Red Hat OpenShift Pipelines Pipelines as Code Watcher" \
28+
maintainer="[email protected]" \
29+
description="Red Hat OpenShift Pipelines Pipelines as Code Watcher" \
30+
io.k8s.display-name="Red Hat OpenShift Pipelines Pipelines as Code Watcher" \
31+
io.k8s.description="Red Hat OpenShift Pipelines Pipelines as Code Watcher" \
32+
io.openshift.tags="pipelines,tekton,openshift"
33+
34+
RUN microdnf install -y shadow-utils
35+
RUN groupadd -r -g 65532 nonroot && useradd --no-log-init -r -u 65532 -g nonroot nonroot
36+
USER 65532
37+
38+
ENTRYPOINT ["/ko-app/pipelines-as-code-watcher"]

‎.konflux/dockerfiles/webhook.Dockerfile

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
ARG GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:v1.22
2+
ARG RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:c0e70387664f30cd9cf2795b547e4a9a51002c44a4a86aa9335ab030134bf392
3+
4+
FROM $GO_BUILDER AS builder
5+
6+
WORKDIR /go/src/github.com/openshift-pipelines/pipelines-as-code
7+
COPY . .
8+
RUN set -e; for f in patches/*.patch; do echo ${f}; [[ -f ${f} ]] || continue; git apply ${f}; done
9+
ENV GODEBUG="http2server=0"
10+
RUN git rev-parse HEAD > /tmp/HEAD
11+
RUN go build -ldflags="-s -w" -mod=vendor -tags disable_gcp -v -o /tmp/pipelines-as-code-webhook \
12+
./cmd/pipelines-as-code-webhook
13+
14+
FROM $RUNTIME
15+
ARG VERSION=pipelines-as-code-webhook-main
16+
17+
ENV KO_APP=/ko-app \
18+
KO_DATA_PATH=/kodata
19+
20+
COPY --from=builder /tmp/pipelines-as-code-webhook ${KO_APP}/pipelines-as-code-webhook
21+
COPY --from=builder /tmp/HEAD ${KO_DATA_PATH}/HEAD
22+
23+
LABEL \
24+
com.redhat.component="openshift-pipelines-pipelines-as-code-webhook-container" \
25+
name="openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8" \
26+
version=$VERSION \
27+
summary="Red Hat OpenShift Pipelines Pipelines as Code Webhook" \
28+
maintainer="[email protected]" \
29+
description="Red Hat OpenShift Pipelines Pipelines as Code Webhook" \
30+
io.k8s.display-name="Red Hat OpenShift Pipelines Pipelines as Code Webhook" \
31+
io.k8s.description="Red Hat OpenShift Pipelines Pipelines as Code Webhook" \
32+
io.openshift.tags="pipelines,tekton,openshift"
33+
34+
RUN microdnf install -y shadow-utils
35+
RUN groupadd -r -g 65532 nonroot && useradd --no-log-init -r -u 65532 -g nonroot nonroot
36+
USER 65532
37+
38+
ENTRYPOINT ["/ko-app/pipelines-as-code-webhook"]

‎.konflux/patches/.placeholder

Whitespace-only changes.

‎.konflux/rpms/rpms.in.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
contentOrigin:
2+
repofiles:
3+
- ./ubi.repo
4+
packages: [shadow-utils]
5+
arches:
6+
# The list of architectures
7+
- aarch64
8+
- x86_64
9+
- ppc64le
10+
- s390x

0 commit comments

Comments
 (0)