8000 Enable SHA pinning with incremental container images numbers by andreaTP · Pull Request #12110 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Enable SHA pinning with incremental container images numbers #12110

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
andreaTP wants to merge 1 commit into from
Closed

Enable SHA pinning with incremental container images numbers #12110

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions .github/scripts/incremental-tag.sh
View file 8000
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
#! /bin/bash
set -euo pipefail

SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )

image=$1
tag=${2:-$(cd $SCRIPT_DIR/../../ && mvn help:evaluate -Dexpression=project.version -q -DforceStdout)}
original_tag=$tag
c=1

while :
do
tag="${original_tag}-${c}"
if DOCKER_CLI_EXPERIMENTAL=enabled docker manifest inspect $image:$tag >/dev/null 2>/dev/null; then
c=$((c+1))
else
echo "-${c}"
break
fi
done
@ASzc ASzc May 31, 2022
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This loop doesn't seem necessary.

With anonymous access to the quay API, we can list all the current tags, and determine what the next value for c should be from that:

curl -sSfL 'https://quay.io/api/v1/repository/keycloak/keycloak/tag/? class="pl-pds">' | jq -r '.tags | .[] | .name' | head
nightly
latest
18.0
18.0.0
legacy
18.0.0-legacy
17.0.1-legacy
17.0
17.0.1
17.0.0-legacy

@andreaTP andreaTP May 31, 2022
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If I read correctly the documentation:
https://docs.quay.io/api/swagger/#!/tag/listRepoTags
the endpoint you are suggesting will return a paged result and the order is not specified.

@ASzc ASzc Jun 1, 2022
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, that's true. The order does seem to be the time of modification, but that's not specified. Here's a more complete solution:

#!/bin/bash

set -xeuo pipefail

repo="${1:-keycloak/keycloak}"
original_tag="${2:-18.0.0}"

tmp_json="$(mktemp)"
tmp_tags="$(mktemp)"
trap "rm -f '$tmp_json' '$tmp_tags'" EXIT
page=1
while true
do
    curl -sSfL "https://quay.io/api/v1/repository/$repo/tag/? class="pl-smi">$page" > "$tmp_json"
    jq -r '.tags | .[] | .name' "$tmp_json" >> "$tmp_tags"

    if jq '.has_additional' "$tmp_json" | grep -qxF 'true'
    then
        (( page+=1 ))
    else
        break
    fi
done

c="$(sort -Vu "$tmp_tags" | grep -F "$original_tag" | grep -Ee '-[0-9]+$' | tail -n1 | rev | cut -d- -f1 | rev || true)"
[ -n "$c" ] || c=0
(( c+=1 ))

echo "New suffix: $c"

@andreaTP andreaTP Jun 1, 2022
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the update @ASzc !
This is again a similar tradeoff as the other PR 🙂 , I do believe that plain docker commands are preferable for this task since they work with any Docker registry.
Also, the overall complexity of your proposed solution (although shows great bash skills 🙂 ) seems to be a little higher than my proposal.

It would be nice to have a third opinion to break the tie, cc. @abstractj @stianst

12 changes: 10 additions & 2 deletions .github/workflows/release-container.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@
- '[0-9]+.[0-9]+.[0-9]+'
concurrency: keycloak-container-release

env:
QUAY_IMAGE: quay.io/keycloak/keycloak
DOCKER_IMAGE: keycloak/keycloak

jobs:
publish:
if: github.repository == 'keycloak/keycloak'
Expand All @@ -19,6 +23,9 @@

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2

- name: Set incremental number
run: echo "INCREMENTAL=$(.github/scripts/incremental-tag.sh ${{ env.QUAY_IMAGE }})" >> $GITHUB_ENV

- name: Login to Quay
uses: docker/login-action@v2
Expand All @@ -38,12 +45,13 @@
uses: docker/metadata-action@v4
with:
images: |
keycloak/keycloak
quay.io/keycloak/keycloak
${{ env.DOCKER_IMAGE }}
${{ env.QUAY_IMAGE }}
tags: |
type=ref,event=branch
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=semver,pattern={{version}},suffix=${{ env.INCREMENTAL }}
@ASzc ASzc May 31, 2022
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

suffix may require you to add the separator (e.g. -) in there too? It's not well documented...

https://github.com/docker/metadata-action#typesemver doesn't really say much

@andreaTP andreaTP May 31, 2022
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yup, is not well documented, we are adding the - here ATM:
https://github.com/keycloak/keycloak/pull/12110/files#diff-f7c3b7edcf25a48a41b690612fbd1d9bd1ceb29dff4a1c04234d8167ed1500d6R17


- name: Build and push the image
uses: docker/build-push-action@v3
Expand Down
10 changes: 8 additions & 2 deletions .github/workflows/release-operator-container.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@ concurrency: keycloak-operator-container-release

env:
JDK_VERSION: 11
QUAY_IMAGE: quay.io/keycloak/keycloak-operator
DOCKER_IMAGE: keycloak/keycloak-operator

jobs:
publish:
Expand All @@ -28,6 +30,9 @@ jobs:
run: |
mvn -P operator -pl operator -am clean install -DskipTests

- name: Set incremental number
run: echo "INCREMENTAL=$(.github/scripts/incremental-tag.sh ${{ env.QUAY_IMAGE }})" >> $GITHUB_ENV

- name: Login to Quay
uses: docker/login-action@v2
with:
Expand All @@ -47,12 +52,13 @@ jobs:
uses: docker/metadata-action@v4
with:
images: |
keycloak/keycloak-operator
quay.io/keycloak/keycloak-operator
${{ env.DOCKER_IMAGE }}
${{ env.QUAY_IMAGE }}
tags: |
type=ref,event=branch
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=semver,pattern={{version}},suffix=${{ env.INCREMENTAL }}

- name: Build and push the operator image
working-directory: operator
Expand Down
0