Skip to content

Commit 3a4bd56

Browse files
meiserlohcesmarvin
meiserloh
authored and
cesmarvin
committed
Merge branch 'release/v3.6.4-6'
2 parents d8991dc + 8a3c4ed commit 3a4bd56

22 files changed

+945
-74
lines changed

‎CHANGELOG.md

+4
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
66

77
## [Unreleased]
88

9+
## [v3.6.4-6] - 2023-12-04
10+
### Fixed
11+
- [#22] Fixed a bug where multiple masks for a destination ip would result in multi line input for cidr generation.
12+
913
## [v3.6.4-5] - 2023-06-27
1014
### Added
1115
- [#20] Configuration options for resource requirements

‎Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
FROM registry.cloudogu.com/official/base:3.17.3-2
22
LABEL NAME="official/postfix" \
3-
VERSION="3.6.4-5" \
3+
VERSION="3.6.4-6" \
44
[email protected]
55

66
# INSTALL POSTFIX

‎Jenkinsfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!groovy
2-
@Library(['github.com/cloudogu/ces-build-lib@1.65.0', 'github.com/cloudogu/dogu-build-lib@v2.1.0'])
2+
@Library(['github.com/cloudogu/ces-build-lib@1.67.0', 'github.com/cloudogu/dogu-build-lib@v2.3.0'])
33
import com.cloudogu.ces.cesbuildlib.*
44
import com.cloudogu.ces.dogubuildlib.*
55

‎Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
MAKEFILES_VERSION=7.5.0
1+
MAKEFILES_VERSION=8.8.0
22

33
.DEFAULT_GOAL:=dogu-release
44

‎build/make/bats/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@ ARG BATS_TAG
44
FROM ${BATS_BASE_IMAGE}:${BATS_TAG}
55

66
# Make bash more findable by scripts and tests
7-
RUN apk add make git bash
7+
RUN apk add make git bash

‎build/make/coder-lib.sh

+182
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
#!/bin/bash
2+
# a collection of helpful functions to update coder workspaces for rapid development
3+
set -e -u -x -o pipefail
4+
5+
function getContainerBin() {
6+
if [ -x "$(command -v podman)" ]; then
7+
echo "podman";
8+
else
9+
echo "docker";
10+
fi
11+
}
12+
13+
function getCoderUser() {
14+
# check if coder is installed, so that there is no problem with build and release targets if this is called before
15+
if [ -x "$(command -v coder)" ]; then
16+
coder users show me -o json | jq -r '.username';
17+
fi
18+
}
19+
20+
function getAllWorkspaces() {
21+
coder list -c workspace | tail -n+2
22+
}
23+
24+
function doesWorkspaceExist() {
25+
coderUser="$1"
26+
workspaceName="$2"
27+
28+
workspace=$(coder list -a -o json | jq -r "select(.[].owner_name == \"${coderUser}\" and .[].name == \"${workspaceName}\") | .[0].name")
29+
if [ -z "$workspace" ]; then
30+
return 1 #workspace does not exist
31+
else
32+
return 0
33+
fi
34+
}
35+
36+
function generateUniqueWorkspaceName() {
37+
local wantedWorkspacePrefix="$1"
38+
# use time to make name unique
39+
local time
40+
time=$(date +'%H-%M-%S')
41+
local lengthOfTime=${#time}
42+
local delimiter='-'
43+
local lengthOfDelimiter=${#delimiter}
44+
# trim prefix, as workspace names are limited to 32 chars
45+
local trimmedPrefix="${wantedWorkspacePrefix:0:$((32 - lengthOfDelimiter - lengthOfTime))}"
46+
local uniqueName="${trimmedPrefix}${delimiter}${time}"
47+
# '--' is forbidden in coder, replace multiple '-' with a single one.
48+
echo "${uniqueName}" | awk '{gsub(/[-]+/,"-")}1'
49+
# returns sth like 'myPrefix-12-45-23'
50+
}
51+
52+
function buildImage() {
53+
local tag="$1"
54+
local containerBuildDir="${2:-./container}"
55+
local secretDir="${3:-./secrets}"
56+
local containerExec="${4:-podman}"
57+
58+
# include build-secrets if there are any
59+
local secretArgs=()
60+
if [ -d "$secretDir" ]; then
61+
# shellcheck disable=SC2231
62+
for secretPath in $secretDir/*; do
63+
# do not match .sh scripts
64+
[[ $secretPath == *.sh ]] && continue
65+
local secretName
66+
secretName=$(basename "$secretPath")
67+
secretArgs+=("--secret=id=$secretName,src=$secretDir/$secretName")
68+
done
69+
fi
70+
71+
if [ "$containerExec" = "podman" ]; then
72+
$containerExec build -t "$tag" --pull=newer "$containerBuildDir" "${secretArgs[@]}"
73+
else
74+
$containerExec build -t "$tag" --pull "$containerBuildDir" "${secretArgs[@]}"
75+
fi
76+
}
77+
78+
function doTrivyConvert() {
79+
local trivyFlags=$1
80+
local outputFile=$2
81+
local containerExec=$3
82+
local jsonScanToConvert=$4
83+
84+
local containerJsonScanFile="/tmp/scan.json"
85+
86+
# shellcheck disable=SC2086
87+
# as globbing is what we want here
88+
"$containerExec" run --rm --pull=always \
89+
-v trivy-cache:/root/.cache \
90+
-v "$jsonScanToConvert:$containerJsonScanFile" \
91+
aquasec/trivy -q \
92+
convert $trivyFlags "$containerJsonScanFile" > "$outputFile"
93+
}
94+
95+
function uploadTemplate() {
96+
local templateDir="${1:?"Error. you need to add the template directory as the first parameter"}"
97+
local templateName="${2:?"Error. you need to add the template name as the second parameter"}"
98+
# for terraform variables (not editable by workspace users)
99+
local variablesFile="${templateDir}/variables.yaml"
100+
if [ -f "$variablesFile" ]; then
101+
local doesVariablesFileExist=1
102+
fi
103+
if ! coder template push -y -d "$templateDir" ${doesVariablesFileExist:+--variables-file "$variablesFile"} "$templateName"; then
104+
# if template does not exist yet, create it in coder
105+
coder template create -y -d "$templateDir" ${doesVariablesFileExist:+--variables-file "$variablesFile"} "$templateName"
106+
fi
107+
}
108+
109+
function createNewWorkspace() {
110+
local templateName="$1"
111+
local workspaceName="$2"
112+
# 3. param is optional, set it to autofill prompts for coder params
113+
local templateDir="${3-unset}"
114+
local richParametersFile="${templateDir}/rich-parameters.yaml"
115+
if [ -n "${templateDir+x}" ] && [ -f "$richParametersFile" ]; then
116+
local doesRichParametersFileExist=1
117+
fi
118+
coder create -t "$templateName" -y "$workspaceName" ${doesRichParametersFileExist:+--rich-parameter-file "$richParametersFile"}
119+
}
120+
121+
function removeAllOtherWorkspaces() {
122+
local CODER_USER="$1"
123+
local WORKSPACE_PREFIX="$2"
124+
local IGNORED_WORKSPACE="$3"
125+
WORKSPACES="$(getAllWorkspaces)"
126+
for ws in $WORKSPACES; do
127+
if [ "$ws" != "$CODER_USER/$IGNORED_WORKSPACE" ] && [[ "$ws" =~ ^"$CODER_USER/$WORKSPACE_PREFIX" ]]; then
128+
echo "delete $ws"
129+
if ! coder delete "$ws" -y; then
130+
#do it twice as podman always throws an error at the first time
131+
coder delete "$ws" -y
132+
fi
133+
fi
134+
done
135+
}
136+
137+
function updateWorkspace() {
138+
local coderUser="$1"
139+
local workspaceName="$2"
140+
local qualifiedWorkspaceName="$coderUser/$workspaceName"
141+
if ! coder stop "$qualifiedWorkspaceName" -y; then
142+
#do it twice as podman always throws an error at the first time
143+
coder stop "$qualifiedWorkspaceName" -y
144+
fi
145+
coder update "$qualifiedWorkspaceName"
146+
}
147+
148+
function startTestWorkspace() {
149+
local coderUser="$1"
150+
local templateDir="$2"
151+
local workspacePrefix="$3"
152+
local templateName="$4"
153+
local reuseTestWorkspace="$5"
154+
155+
local newWorkspaceName
156+
if [ "$reuseTestWorkspace" = false ]; then
157+
newWorkspaceName="$(generateUniqueWorkspaceName "$workspacePrefix")"
158+
# do that before deleting others, so that i don't need to wait
159+
createNewWorkspace "$templateName" "$newWorkspaceName" "$templateDir"
160+
# trim prefix as the name of the workspace can also get trimmed
161+
removeAllOtherWorkspaces "$coderUser" "${workspacePrefix:0:22}" "$newWorkspaceName"
162+
else
163+
newWorkspaceName="$workspacePrefix"
164+
if ! doesWorkspaceExist "$coderUser" "$newWorkspaceName"; then
165+
createNewWorkspace "$templateName" "$newWorkspaceName" "$templateDir"
166+
else
167+
updateWorkspace "$coderUser" "$newWorkspaceName"
168+
fi
169+
fi
170+
}
171+
172+
function uploadToNexus() {
173+
local fileToUpload="$1"
174+
local fileNameNexus="${fileToUpload##*/}"
175+
local templateName="$2"
176+
local releaseVersion="$3"
177+
local nexusUrl="${4:-https://ecosystem.cloudogu.com/nexus/repository/itz-bund/coder}"
178+
set +x #disable command printing because of the password
179+
curl --progress-bar -u "$(cat secrets/nexus-user):$(cat secrets/nexus-pw)" --upload-file "$fileToUpload" \
180+
"$nexusUrl/$templateName/$releaseVersion/$fileNameNexus"
181+
set -x
182+
}

‎build/make/coder.mk

+159
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
SHELL := /bin/bash
2+
3+
IMAGE_TAG?=${IMAGE_REGISTRY}/coder/coder-${TEMPLATE_NAME}:${VERSION}
4+
REUSE_TEST_WORKSPACE?=false
5+
6+
#BUILD_DIR given via variables.mk
7+
TEMPLATE_DIR=${WORKDIR}/template
8+
CONTAINER_BUILD_DIR=${WORKDIR}/container
9+
SECRETS_DIR=${WORKDIR}/secrets
10+
CODER_LIB_PATH=${BUILD_DIR}/make/coder-lib.sh
11+
12+
RELEASE_DIR=${WORKDIR}/release
13+
MAKE_CHANGE_TOKEN_DIR=${RELEASE_DIR}/make
14+
CONTAINER_FILE?=${CONTAINER_BUILD_DIR}/Dockerfile
15+
CONTAINER_IMAGE_CHANGE_TOKEN?=${MAKE_CHANGE_TOKEN_DIR}/${TEMPLATE_NAME}_image_id.txt
16+
CONTAINER_IMAGE_TAR?=${RELEASE_DIR}/${TEMPLATE_NAME}.tar
17+
CONTAINER_IMAGE_TARGZ?=${RELEASE_DIR}/${TEMPLATE_NAME}.tar.gz
18+
CONTAINER_IMAGE_TRIVY_SCAN_JSON?=${RELEASE_DIR}/trivy.json
19+
CONTAINER_IMAGE_TRIVY_SCAN_TABLE?=${RELEASE_DIR}/trivy.txt
20+
CONTAINER_IMAGE_TRIVY_SCAN_CRITICAL_TABLE?=${RELEASE_DIR}/trivy_critical.txt
21+
CONTAINER_IMAGE_TRIVY_SCAN_CRITICAL_JSON?=${RELEASE_DIR}/trivy_critical.json
22+
23+
IMAGE_REGISTRY?=registry.cloudogu.com
24+
IMAGE_REGISTRY_USER_FILE?=${SECRETS_DIR}/harbor-user
25+
IMAGE_REGISTRY_PW_FILE?=${SECRETS_DIR}/harbor-pw
26+
27+
CHANGELOG_FILE=${WORKDIR}/CHANGELOG.md
28+
TEMPLATE_RELEASE_TAR_GZ=${RELEASE_DIR}/${TEMPLATE_NAME}-template.tar.gz
29+
30+
TEST_WORKSPACE_PREFIX?=test-${TEMPLATE_NAME}
31+
CODER_USER?=$(shell . ${CODER_LIB_PATH} && getCoderUser)
32+
33+
CONTAINER_BIN?=$(shell . ${CODER_LIB_PATH} && getContainerBin)
34+
GOPASS_BIN?=$(shell command -v gopass 2> /dev/null)
35+
36+
EXCLUDED_TEMPLATE_FILES?=rich-parameters.yaml variables.yaml
37+
38+
39+
##@ Coder template development
40+
41+
${SECRETS_DIR}:
42+
mkdir -p ${SECRETS_DIR}
43+
44+
${IMAGE_REGISTRY_USER_FILE}: ${SECRETS_DIR}
45+
ifeq ($(ENVIRONMENT), local)
46+
@echo "Found developer environment. creating secret ${IMAGE_REGISTRY_USER_FILE}"
47+
@${GOPASS_BIN} show ces/websites/registry.cloudogu.com/robot_coder_jenkins | tail -n 1 | sed -e "s/^username: //" > ${IMAGE_REGISTRY_USER_FILE};
48+
else
49+
@echo "Found CI environment. Please create secrets yourself"
50+
endif
51+
52+
${IMAGE_REGISTRY_PW_FILE}: ${SECRETS_DIR}
53+
ifeq ($(ENVIRONMENT), local)
54+
@echo "Found developer environment. creating secret ${IMAGE_REGISTRY_PW_FILE}"
55+
@${GOPASS_BIN} show ces/websites/registry.cloudogu.com/robot_coder_jenkins | head -n 1 > ${IMAGE_REGISTRY_PW_FILE};
56+
else
57+
@echo "Found CI environment. Please create secrets yourself"
58+
endif
59+
60+
.PHONY: loadGopassSecrets
61+
loadGopassSecrets: ${IMAGE_REGISTRY_USER_FILE} ${IMAGE_REGISTRY_PW_FILE} ${ADDITIONAL_SECRETS_TARGET} ## load secrets from gopass into secret files, so that the build process works locally
62+
63+
.PHONY: imageRegistryLogin
64+
imageRegistryLogin: loadGopassSecrets ${IMAGE_REGISTRY_USER_FILE} ${IMAGE_REGISTRY_PW_FILE} ## log in to the registry
65+
@${CONTAINER_BIN} login -u "$$(cat ${IMAGE_REGISTRY_USER_FILE})" --password-stdin '${IMAGE_REGISTRY}' < ${IMAGE_REGISTRY_PW_FILE}
66+
67+
.PHONY: imageRegistryLogout
68+
imageRegistryLogout: ## log out of the registry
69+
@${CONTAINER_BIN} logout '${IMAGE_REGISTRY}'
70+
71+
.PHONY: buildImage
72+
buildImage: buildImage-$(ENVIRONMENT) ## build the container image
73+
74+
.PHONY: buildImage-local
75+
buildImage-local: imageRegistryLogin ${CONTAINER_IMAGE_CHANGE_TOKEN} ## build the container image locally
76+
@echo "if the build is not triggered without a change in the dockerfile, try to delete ${CONTAINER_IMAGE_CHANGE_TOKEN}"
77+
78+
.PHONY: buildImage-ci
79+
buildImage-ci: ${CONTAINER_IMAGE_CHANGE_TOKEN} ## build the container image without automatic secret management
80+
81+
${CONTAINER_IMAGE_CHANGE_TOKEN}: ${CONTAINER_FILE}
82+
@. ${CODER_LIB_PATH} && buildImage ${IMAGE_TAG} ${CONTAINER_BUILD_DIR} ${SECRETS_DIR} ${CONTAINER_BIN}
83+
@mkdir -p ${MAKE_CHANGE_TOKEN_DIR}
84+
@${CONTAINER_BIN} image ls --format="{{.ID}}" ${IMAGE_TAG} > ${CONTAINER_IMAGE_CHANGE_TOKEN}
85+
86+
.PHONY: uploadTemplate
87+
uploadTemplate: ## upload template to coder server
88+
@. ${CODER_LIB_PATH} && uploadTemplate ${TEMPLATE_DIR} ${TEMPLATE_NAME}
89+
90+
.PHONY: startTestWorkspace
91+
startTestWorkspace: ## start a test workspace with coder
92+
@. ${CODER_LIB_PATH} && startTestWorkspace ${CODER_USER} ${TEMPLATE_DIR} ${TEST_WORKSPACE_PREFIX} ${TEMPLATE_NAME} ${REUSE_TEST_WORKSPACE}
93+
94+
.PHONY: createImageRelease
95+
createImageRelease: ${CONTAINER_IMAGE_TARGZ} ## export the container image as a tar.gz
96+
97+
${CONTAINER_IMAGE_TAR}: ${CONTAINER_IMAGE_CHANGE_TOKEN}
98+
${CONTAINER_BIN} save "${IMAGE_TAG}" -o ${CONTAINER_IMAGE_TAR}
99+
100+
${CONTAINER_IMAGE_TARGZ}: ${CONTAINER_IMAGE_TAR}
101+
gzip -f --keep "${CONTAINER_IMAGE_TAR}"
102+
103+
.PHONY: trivyscanImage
104+
trivyscanImage: ${CONTAINER_IMAGE_TRIVY_SCAN_JSON} ${CONTAINER_IMAGE_TRIVY_SCAN_TABLE} ${CONTAINER_IMAGE_TRIVY_SCAN_CRITICAL_TABLE} ${CONTAINER_IMAGE_TRIVY_SCAN_CRITICAL_JSON} ## do a trivy scan for the workspace image in various output formats
105+
106+
${CONTAINER_IMAGE_TRIVY_SCAN_JSON}: ${CONTAINER_IMAGE_TAR}
107+
${CONTAINER_BIN} run --rm --pull=always \
108+
-v "trivy-cache:/root/.cache" \
109+
-v "${CONTAINER_IMAGE_TAR}:/tmp/image.tar" \
110+
aquasec/trivy -q \
111+
image --scanners vuln --input /tmp/image.tar -f json --timeout 15m \
112+
> ${CONTAINER_IMAGE_TRIVY_SCAN_JSON}
113+
114+
${CONTAINER_IMAGE_TRIVY_SCAN_TABLE}: ${CONTAINER_IMAGE_TRIVY_SCAN_JSON}
115+
@. ${CODER_LIB_PATH} && \
116+
doTrivyConvert "--format table" ${CONTAINER_IMAGE_TRIVY_SCAN_TABLE} ${CONTAINER_BIN} ${CONTAINER_IMAGE_TRIVY_SCAN_JSON}
117+
118+
${CONTAINER_IMAGE_TRIVY_SCAN_CRITICAL_TABLE}: ${CONTAINER_IMAGE_TRIVY_SCAN_JSON}
119+
@. ${CODER_LIB_PATH} && \
120+
doTrivyConvert "--format table --severity CRITICAL" ${CONTAINER_IMAGE_TRIVY_SCAN_CRITICAL_TABLE} ${CONTAINER_BIN} ${CONTAINER_IMAGE_TRIVY_SCAN_JSON}
121+
122+
${CONTAINER_IMAGE_TRIVY_SCAN_CRITICAL_JSON}: ${CONTAINER_IMAGE_TRIVY_SCAN_JSON}
123+
@. ${CODER_LIB_PATH} && \
124+
doTrivyConvert "--format json --severity CRITICAL" ${CONTAINER_IMAGE_TRIVY_SCAN_CRITICAL_JSON} ${CONTAINER_BIN} ${CONTAINER_IMAGE_TRIVY_SCAN_JSON}
125+
126+
.PHONY: createTemplateRelease
127+
createTemplateRelease: ## generate template.tar.gz with all files needed for customers
128+
# remove release dir first as 'cp' cannot merge and will place the source dir inside the target dir if it already exists
129+
rm -rf "${RELEASE_DIR}/${TEMPLATE_NAME}"
130+
cp -r "${TEMPLATE_DIR}" "${RELEASE_DIR}/${TEMPLATE_NAME}/"
131+
#copy changelog
132+
cp "${CHANGELOG_FILE}" "${RELEASE_DIR}/${TEMPLATE_NAME}/"
133+
# remove excludes
134+
for file in "${EXCLUDED_TEMPLATE_FILES}"; do \
135+
rm -f "${RELEASE_DIR}/${TEMPLATE_NAME}/$$file"; \
136+
done
137+
tar -czf "${RELEASE_DIR}/${TEMPLATE_NAME}-template.tar.gz" -C "${RELEASE_DIR}" "${TEMPLATE_NAME}"
138+
139+
.PHONY: createRelease ## generate template- and container archives and the trivy scans
140+
createRelease: createTemplateRelease ${CONTAINER_IMAGE_TARGZ} trivyscanImage ## create the image.tar.gz, template.tar.gz and trivy scans
141+
142+
.PHONY: cleanCoderRelease
143+
cleanCoderRelease: ## clean release directory
144+
rm -rf "${RELEASE_DIR}"
145+
mkdir -p "${RELEASE_DIR}"
146+
147+
.PHONY: pushImage
148+
pushImage: ## push the container image into the registry
149+
${CONTAINER_BIN} push ${IMAGE_TAG}
150+
151+
.PHONY: uploadRelease
152+
uploadRelease: createTemplateRelease ${CONTAINER_IMAGE_TARGZ} ${CONTAINER_IMAGE_TRIVY_SCAN_JSON} ${CONTAINER_IMAGE_TRIVY_SCAN_TABLE} ${CONTAINER_IMAGE_TRIVY_SCAN_CRITICAL_TABLE} ${CONTAINER_IMAGE_TRIVY_SCAN_CRITICAL_JSON} ## upload release artifacts to nexus
153+
@. ${CODER_LIB_PATH} && uploadToNexus ${TEMPLATE_RELEASE_TAR_GZ} ${TEMPLATE_NAME} ${VERSION}
154+
@. ${CODER_LIB_PATH} && uploadToNexus ${CONTAINER_IMAGE_TRIVY_SCAN_JSON} ${TEMPLATE_NAME} ${VERSION}
155+
@. ${CODER_LIB_PATH} && uploadToNexus ${CONTAINER_IMAGE_TRIVY_SCAN_TABLE} ${TEMPLATE_NAME} ${VERSION}
156+
@. ${CODER_LIB_PATH} && uploadToNexus ${CONTAINER_IMAGE_TRIVY_SCAN_CRITICAL_TABLE} ${TEMPLATE_NAME} ${VERSION}
157+
@. ${CODER_LIB_PATH} && uploadToNexus ${CONTAINER_IMAGE_TRIVY_SCAN_CRITICAL_JSON} ${TEMPLATE_NAME} ${VERSION}
158+
@. ${CODER_LIB_PATH} && uploadToNexus ${CONTAINER_IMAGE_TARGZ} ${TEMPLATE_NAME} ${VERSION}
159+

0 commit comments

Comments
 (0)