mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Aleksei Sviridkin
fbfabbfdf2
The image build already fails on patch drift, but only when the image is built. Check the patch against the freshly vendored upstream tag inside make update as well, so the author of a cilium version bump sees the drift immediately instead of at the next image build. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
52 lines
2.8 KiB
Makefile
52 lines
2.8 KiB
Makefile
CILIUM_TAG=$(shell awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml)
|
|
|
|
export NAME=cilium
|
|
export NAMESPACE=cozy-$(NAME)
|
|
|
|
include ../../../hack/common-envs.mk
|
|
include ../../../hack/package.mk
|
|
|
|
update:
|
|
rm -rf charts
|
|
helm repo add cilium https://helm.cilium.io/
|
|
helm repo update cilium
|
|
helm pull cilium/cilium --untar --untardir charts --version 1.19
|
|
$(SED_INPLACE) -e '/Used in iptables/d' -e '/SYS_MODULE/d' charts/cilium/values.yaml
|
|
# Drop the whole k8s<1.30 AppArmor annotations block from the cilium-agent
|
|
# DaemonSet. Cozystack manages these annotations through cilium.podAnnotations
|
|
# in values.yaml on every k8s version, so keeping the upstream block would
|
|
# produce duplicate mapping keys on k8s<1.30.
|
|
perl -i -0pe 's|\n \{\{- if not \.Values\.securityContext\.privileged \}\}\n \{\{- if semverCompare "<1\.30\.0".*?\n \{\{- end \}\}\n \{\{- end \}\}\n \{\{- end \}\}||s' \
|
|
charts/cilium/templates/cilium-agent/daemonset.yaml
|
|
@! grep -q 'container\.apparmor\.security\.beta\.kubernetes\.io' \
|
|
charts/cilium/templates/cilium-agent/daemonset.yaml || \
|
|
{ echo 'ERROR: perl patch did not remove the upstream AppArmor block from cilium-agent/daemonset.yaml (upstream template format may have changed)' >&2; exit 1; }
|
|
version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \
|
|
$(SED_INPLACE) "s/ARG VERSION=.*/ARG VERSION=v$${version}/" images/cilium/Dockerfile
|
|
# Verify the IPv6-passthrough BPF patch still applies to the new upstream tag,
|
|
# so the bump author learns about drift immediately instead of at image build.
|
|
version=$$(awk '$$1 == "version:" {print $$2}' charts/cilium/Chart.yaml) && \
|
|
tmpdir=$$(mktemp -d) && \
|
|
{ curl --fail --silent --show-error --location \
|
|
"https://raw.githubusercontent.com/cilium/cilium/v$${version}/bpf/bpf_host.c" \
|
|
-o "$$tmpdir/bpf_host.c" || { rm -rf "$$tmpdir"; exit 1; }; } && \
|
|
{ patch --dry-run --batch --forward --fuzz=0 -p1 -d "$$tmpdir" \
|
|
< images/cilium/patches/pass-ipv6-to-stack-when-ipv6-datapath-disabled.diff || \
|
|
{ echo "ERROR: images/cilium/patches/pass-ipv6-to-stack-when-ipv6-datapath-disabled.diff no longer applies to upstream bpf/bpf_host.c v$${version}; regenerate it for the new cilium version" >&2; \
|
|
rm -rf "$$tmpdir"; exit 1; }; } && \
|
|
rm -rf "$$tmpdir"
|
|
|
|
image:
|
|
docker buildx build images/cilium \
|
|
$(call image-tags,cilium,$(CILIUM_TAG)) \
|
|
$(call cache-args,cilium) \
|
|
--metadata-file images/cilium.json \
|
|
$(BUILDX_ARGS)
|
|
REPOSITORY="$(REGISTRY)/cilium" \
|
|
yq -i '.cilium.image.repository = strenv(REPOSITORY)' values.yaml
|
|
TAG=$(IMAGE_TAG) \
|
|
yq -i '.cilium.image.tag = strenv(TAG)' values.yaml
|
|
DIGEST=$$(yq e '."containerimage.digest"' images/cilium.json -o json -r) \
|
|
yq -i '.cilium.image.digest = strenv(DIGEST)' values.yaml
|
|
rm -f images/cilium.json
|