Skip to content

Commit b5e0fb7

Browse files
jetstack-botjetstack-bot
authored
Merge pull request #93 from JoshVanL/image-tags-v0.2.1
Adds support for making multi-arch images. Updates tags
2 parents bd01bea + b49eca7 commit b5e0fb7

File tree

9 files changed

+74
-124
lines changed

9 files changed

+74
-124
lines changed

‎Dockerfile‎

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,29 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
FROM gcr.io/distroless/static@sha256:aadea1b1f16af043a34491eec481d0132479382096ea34f608087b4bef3634be
15+
# Build the istio-csr binary
16+
FROM docker.io/library/golang:1.17 as builder
17+
18+
WORKDIR /workspace
19+
# Copy the Go Modules manifests
20+
COPY go.mod go.mod
21+
COPY go.sum go.sum
22+
23+
# Copy the go source files
24+
COPY Makefile Makefile
25+
COPY cmd/ cmd/
26+
COPY pkg/ pkg/
27+
28+
# Build
29+
RUN make build
30+
31+
# Use distroless as minimal base image to package the manager binary
32+
# Refer to https://github.com/GoogleContainerTools/distroless for more details
33+
FROM gcr.io/distroless/static@sha256:be5d77c62dbe7fedfb0a4e5ec2f91078080800ab1f18358e5f31fcc8faa023c4
1634
LABEL description="istio certificate agent to serve certificate signing requests via cert-manager"
1735

36+
WORKDIR /
1837
USER 1001
19-
20-
COPY ./bin/cert-manager-istio-csr-linux /usr/bin/cert-manager-istio-csr
38+
COPY --from=builder /workspace/bin/cert-manager-istio-csr /usr/bin/cert-manager-istio-csr
2139

2240
ENTRYPOINT ["/usr/bin/cert-manager-istio-csr"]

‎Makefile‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ ARCH ?= $(shell go env GOARCH)
1717
ISTIO_VERSION ?= 1.10.0
1818
K8S_VERSION ?= 1.21.1
1919
HELM_VERSION ?= 3.4.1
20+
IMAGE_PLATFORMS ?= linux/amd64,linux/arm64,linux/arm/v7,linux/ppc64le
2021

2122
UNAME_S := $(shell uname -s)
2223
ifeq ($(UNAME_S),Linux)
@@ -39,15 +40,15 @@ lint:
3940

4041
build: ## build cert-manager-istio-csr
4142
mkdir -p $(BINDIR)
42-
CGO_ENABLED=0 go build -o ./bin/cert-manager-istio-csr ./cmd/.
43+
CGO_ENABLED=0 go build -v -o ./bin/cert-manager-istio-csr ./cmd/.
4344

4445
verify: test build ## tests and builds cert-manager-istio-csr
4546

46-
build_image_binary: ## builds image binary
47-
GOARCH=$(ARCH) GOOS=linux CGO_ENABLED=0 go build -o ./bin/cert-manager-istio-csr-linux ./cmd/.
48-
49-
image: build_image_binary ## build docker image from binary
50-
docker build -t quay.io/jetstack/cert-manager-istio-csr:v0.2.0 .
47+
# image will only build and store the image locally, targeted in OCI format.
48+
# To actually push an image to the public repo, replace the `--output` flag and
49+
# arguments to `--push`.
50+
image: ## build docker image targeting all supported platforms
51+
docker buildx build --platform=$(IMAGE_PLATFORMS) -t quay.io/jetstack/cert-manager-istio-csr:v0.2.1 --output type=oci,dest=./bin/cert-manager-istio-csr-oci .
5152

5253
clean: ## clean up created files
5354
rm -rf \
@@ -56,7 +57,7 @@ clean: ## clean up created files
5657

5758
all: test build docker ## runs test, build and docker
5859

59-
demo: depend build test build_image_binary ## create kind cluster and deploy demo
60+
demo: depend build test ## create kind cluster and deploy demo
6061
./hack/demo/deploy-demo.sh $(K8S_VERSION) $(ISTIO_VERSION)
6162
$(BINDIR)/kubectl label namespace default istio-injection=enabled
6263

‎deploy/charts/istio-csr/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,5 +12,5 @@ maintainers:
1212
sources:
1313
- https://github.com/cert-manager/istio-csr
1414

15-
appVersion: v0.2.0
16-
version: v0.2.2
15+
appVersion: v0.2.1
16+
version: v0.2.3

‎deploy/charts/istio-csr/README.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
# cert-manager-istio-csr
22

3-
![Version: v0.2.1](https://img.shields.io/badge/Version-v0.2.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.2.0](https://img.shields.io/badge/AppVersion-v0.2.0-informational?style=flat-square)
3+
![Version: v0.2.3](https://img.shields.io/badge/Version-v0.2.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.2.1](https://img.shields.io/badge/AppVersion-v0.2.1-informational?style=flat-square)
44

55
A Helm chart for istio-csr
66

7-
**Homepage:** <https://github.com/jetstack/istio-csr>
7+
**Homepage:** <https://github.com/cert-manager/istio-csr>
88

99
## Maintainers
1010

@@ -27,6 +27,7 @@ A Helm chart for istio-csr
2727
| app.certmanager.preserveCertificateRequests | bool | `false` | Don't delete created CertificateRequests once they have been signed. |
2828
| app.controller.leaderElectionNamespace | string | `"istio-system"` | |
2929
| app.controller.rootCAConfigMapName | string | `"istio-ca-root-cert"` | Name of ConfigMap that should contain the root CA in all namespaces. |
30+
| app.istio.revisions | list | `["default"]` | The istio revisions that are currently installed in the cluster. Changing this field will modify the DNS names that will be requested for the istiod certificate. The common name for the istiod certificate is hard coded to the `default` revision DNS name. Some issuers may require that the common name on certificates match one of the DNS names. If 1. Your issuer has this constraint, and 2. You are not using `default` as a revision, add the `default` revision here anyway. The resulting certificate will include a DNS name that won't be used, but will pass this constraint. |
3031
| app.logLevel | int | `1` | Verbosity of istio-csr logging. |
3132
| app.metrics.port | int | `9402` | Port for exposing Prometheus metrics on 0.0.0.0 on path '/metrics'. |
3233
| app.metrics.service | object | `{"enabled":true,"servicemonitor":{"enabled":false,"interval":"10s","labels":{},"prometheusInstance":"default","scrapeTimeout":"5s"},"type":"ClusterIP"}` | Service to expose metrics endpoint. |
@@ -46,7 +47,7 @@ A Helm chart for istio-csr
4647
| app.tls.trustDomain | string | `"cluster.local"` | The Istio cluster's trust domain. |
4748
| image.pullPolicy | string | `"IfNotPresent"` | Kubernetes imagePullPolicy on Deployment. |
4849
| image.repository | string | `"quay.io/jetstack/cert-manager-istio-csr"` | Target image repository. |
49-
| image.tag | string | `"v0.2.0"` | Target image version tag. |
50+
| image.tag | string | `"v0.2.1"` | Target image version tag. |
5051
| replicaCount | int | `1` | Number of replicas of istio-csr to run. |
5152
| resources | object | `{}` | |
5253
| service.port | int | `443` | Service port to expose istio-csr gRPC service. |

‎deploy/charts/istio-csr/values.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ image:
55
# -- Target image repository.
66
repository: quay.io/jetstack/cert-manager-istio-csr
77
# -- Target image version tag.
8-
tag: v0.2.0
8+
tag: v0.2.1
99
# -- Kubernetes imagePullPolicy on Deployment.
1010
pullPolicy: IfNotPresent
1111

‎hack/demo/deploy-demo.sh‎

Lines changed: 34 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -2,72 +2,58 @@
22

33
K8S_NAMESPACE="${K8S_NAMESPACE:-istio-system}"
44
CERT_MANAGER_VERSION="${CERT_MANAGER_VERSION:-1.4.0}"
5-
ISTIO_AGENT_IMAGE="${CERT_MANAGER_ISTIO_AGENT_IMAGE:-localhost:5000/cert-manager-istio-csr:v0.2.0}"
5+
ISTIO_AGENT_IMAGE="${CERT_MANAGER_ISTIO_AGENT_IMAGE:-quay.io/jetstack/cert-manager-istio-csr:canary}"
66
KUBECTL_BIN="${KUBECTL_BIN:-./bin/kubectl}"
77
HELM_BIN="${HELM_BIN:-./bin/helm}"
88
KIND_BIN="${KIND_BIN:-./bin/kind}"
99

10-
./hack/demo/kind-with-registry.sh $1
11-
12-
echo ">> docker build -t ${ISTIO_AGENT_IMAGE} ."
13-
docker build -t ${ISTIO_AGENT_IMAGE} .
14-
15-
echo ">> docker push ${ISTIO_AGENT_IMAGE}"
16-
docker push $ISTIO_AGENT_IMAGE
17-
18-
apply_cert-manager_bootstrap_manifests() {
19-
$KUBECTL_BIN apply -n $K8S_NAMESPACE -f ./hack/demo/cert-manager-bootstrap-resources.yaml
20-
return $?
21-
}
10+
echo ">> building istio-csr binary..."
11+
GOARCH=$(go env GOARCH) GOOS=linux CGO_ENABLED=0 go build -o ./bin/istio-csr-linux ./cmd/.
12+
13+
echo ">> building docker image..."
14+
docker build -t $ISTIO_AGENT_IMAGE .
15+
16+
echo ">> creating kind cluster..."
17+
$KIND_BIN delete cluster --name istio-demo
18+
cat <<EOF | $KIND_BIN create cluster --name istio-demo --config=-
19+
apiVersion: kind.x-k8s.io/v1alpha4
20+
kind: Cluster
21+
nodes:
22+
- role: control-plane
23+
extraPortMappings:
24+
- containerPort: 30443
25+
hostPort: 30443
26+
listenAddress: "0.0.0.0"
27+
protocol: tcp
28+
kubeadmConfigPatches:
29+
- |
30+
# config generated by kind
31+
apiVersion: kubeadm.k8s.io/v1beta2
32+
kind: ClusterConfiguration
33+
metadata:
34+
name: config
35+
networking:
36+
serviceSubnet: 10.0.0.0/16
37+
EOF
2238

23-
echo ">> loading demo container images into kind"
24-
IMAGES=("quay.io/joshvanl_jetstack/httpbin:latest" "quay.io/joshvanl_jetstack/curl")
25-
IMAGES+=("gcr.io/istio-release/pilot:$2" "gcr.io/istio-release/proxyv2:$2")
26-
for image in ${IMAGES[@]}; do
27-
docker pull $image
28-
$KIND_BIN load docker-image $image --name istio-demo
29-
done
39+
echo ">> loading docker image..."
40+
$KIND_BIN load docker-image $ISTIO_AGENT_IMAGE --name istio-demo
3041

3142
echo ">> installing cert-manager"
32-
$KUBECTL_BIN apply -f https://github.com/jetstack/cert-manager/releases/download/v$CERT_MANAGER_VERSION/cert-manager.yaml
33-
34-
$KUBECTL_BIN rollout status deploy -n cert-manager cert-manager
35-
$KUBECTL_BIN rollout status deploy -n cert-manager cert-manager-cainjector
36-
$KUBECTL_BIN rollout status deploy -n cert-manager cert-manager-webhook
37-
43+
$HELM_BIN repo add jetstack https://charts.jetstack.io --force-update
44+
$HELM_BIN upgrade -i -n cert-manager cert-manager jetstack/cert-manager --set installCRDs=true --wait --create-namespace --set global.logLevel=2
3845

3946
echo ">> creating cert-manager istio resources"
40-
4147
$KUBECTL_BIN create namespace $K8S_NAMESPACE
42-
43-
max=15
44-
45-
for x in $(seq 1 $max); do
46-
apply_cert-manager_bootstrap_manifests
47-
res=$?
48-
49-
if [ $res -eq 0 ]; then
50-
break
51-
fi
52-
53-
echo ">> [${x}] cert-manager not ready" && sleep 5
54-
55-
if [ x -eq 15 ]; then
56-
echo ">> Failed to deploy cert-manager and bootstrap manifests in time"
57-
exit 1
58-
fi
59-
done
48+
$KUBECTL_BIN apply -n $K8S_NAMESPACE -f ./hack/demo/cert-manager-bootstrap-resources.yaml
6049

6150
echo ">> installing cert-manager-istio-csr"
62-
6351
$HELM_BIN install cert-manager-istio-csr ./deploy/charts/istio-csr -n cert-manager --values ./hack/demo/istio-csr-values.yaml
6452

6553
echo ">> installing istio"
66-
6754
./bin/istioctl-$2 install -y -f ./hack/istio-config-$2.yaml
6855

6956
echo ">> enforcing mTLS everywhere"
70-
7157
$KUBECTL_BIN apply -n istio-system -f - <<EOF
7258
apiVersion: "security.istio.io/v1beta1"
7359
kind: "PeerAuthentication"

‎hack/demo/destroy-demo.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,5 @@
22

33
KIND_BIN="${KIND_BIN:-./bin/kind}"
44

5+
$KIND_BIN export logs _artifacts --name istio-demo
56
$KIND_BIN delete cluster --name istio-demo
6-
docker stop kind-registry

‎hack/demo/istio-csr-values.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
replicaCount: 3
22

33
image:
4-
repository: localhost:5000/cert-manager-istio-csr
5-
tag: v0.2.0
6-
pullPolicy: Always
4+
repository: quay.io/jetstack/cert-manager-istio-csr
5+
tag: canary
6+
pullPolicy: Never
77

88
service:
99
port: 443

‎hack/demo/kind-with-registry.sh‎

Lines changed: 0 additions & 56 deletions
This file was deleted.

0 commit comments

Comments
 (0)