mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 22:13:18 +09:00
Aleksei Sviridkin
3a5ff3d9c8
v0.8.0 makes the TCP proxy log an explicit reason when its backend readiness check fails, instead of staying silently NotReady. That silent failure mode is exactly what makes a mispointed proxy backend hard to diagnose, so the upgrade pays off the moment the target is wrong. The bump also carries the v0.7.3 migration of the kubectl sidecar image off Docker Hub to mirror.gcr.io, sidestepping anonymous pull rate-limits on shared CI/runner IPs. Chart manifest and controller image are re-pinned by digest in lockstep with the version, and the image-pin test fixture is updated to match. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
52 lines
2.5 KiB
Makefile
52 lines
2.5 KiB
Makefile
export NAME=ouroboros
|
|
export NAMESPACE=cozy-$(NAME)
|
|
|
|
include ../../../hack/common-envs.mk
|
|
include ../../../hack/package.mk
|
|
|
|
# Pin the upstream ouroboros chart by version AND OCI manifest digest.
|
|
#
|
|
# OUROBOROS_CHART_DIGEST below is the digest of the OCI **chart**
|
|
# manifest at ghcr.io/lexfrei/charts/ouroboros — it pins the contents
|
|
# of the helm chart artefact (templates, values.yaml, Chart.yaml).
|
|
# It is NOT the digest of the controller container image. The image
|
|
# digest lives in values.yaml under image.tag (`image.tag: "<version>@sha256:..."`)
|
|
# and pins ghcr.io/lexfrei/ouroboros (the runtime binary). Both
|
|
# digests have to land together at every chart bump — the chart
|
|
# version, the chart-manifest digest, and the controller-image
|
|
# digest all advance in lockstep with the upstream release.
|
|
#
|
|
# Bump together with the image tag+digest in values.yaml. The digest
|
|
# pin closes the supply-chain hole that a tag-only pull would leave —
|
|
# OCI registries can republish under the same tag, but the manifest
|
|
# digest is immutable. To bump: resolve the new chart-manifest digest
|
|
# with
|
|
# crane manifest ghcr.io/lexfrei/charts/ouroboros:<new-tag> | sha256sum
|
|
# (or `oras manifest fetch ghcr.io/lexfrei/charts/ouroboros:<new-tag> | sha256sum`)
|
|
# and update both lines below; resolve the new image digest with
|
|
# crane digest ghcr.io/lexfrei/ouroboros:<new-tag>
|
|
# and update values.yaml.
|
|
OUROBOROS_CHART_VERSION ?= 0.8.0
|
|
OUROBOROS_CHART_DIGEST ?= sha256:b57255ef65a8eace361bf0e4eb93637e6a45315bc7744746b2e16ffa5bdd3744
|
|
|
|
test:
|
|
helm unittest .
|
|
|
|
update:
|
|
rm -rf charts
|
|
# Pull by digest, then verify Chart.yaml records the expected
|
|
# version. A digest mismatch (someone bumped DIGEST without
|
|
# bumping VERSION, or vice versa) trips the assert and aborts.
|
|
helm pull oci://ghcr.io/lexfrei/charts/ouroboros@$(OUROBOROS_CHART_DIGEST) --untar --untardir charts
|
|
@actual_version=$$(awk '/^version:/ {print $$2}' charts/ouroboros/Chart.yaml | tr -d '"'); \
|
|
if [ "$$actual_version" != "$(OUROBOROS_CHART_VERSION)" ]; then \
|
|
echo "ERROR: pulled chart Chart.yaml version=$$actual_version but Makefile OUROBOROS_CHART_VERSION=$(OUROBOROS_CHART_VERSION). Bump both in lockstep."; \
|
|
exit 1; \
|
|
fi
|
|
# Drop vendored upstream helm-unittest fixtures: the upstream
|
|
# fixtures hard-code upstream defaults that conflict with the
|
|
# cozystack values.yaml overrides (target Service FQDN, mode,
|
|
# Gateway-API gating). The cozystack-side fixtures in tests/
|
|
# are the only ones CI should run.
|
|
rm -rf charts/ouroboros/tests
|