Github Container Registry (#34)

* harbor replaced with ghcr

.github/workflows/commit.yaml → .github/workflows/pipeline.yaml

@@ -12,43 +12,56 @@ on:
     branches:
       - main
     paths-ignore:
-      - '**.md'
+      - 'docs/**'
+      - '**/*.md'
 
 env:
   platforms: linux/amd64
-  registry: core.harbor.onmetal.de
-  image: core.harbor.onmetal.de/onmetal/ipam
+  registry: ghcr.io
+  image: ghcr.io/${{ github.repository_owner }}/ipam
 
 jobs:
   go-lint:
     runs-on: [ self-hosted, Linux, X64 ]
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+
       - name: Setup golang
         uses: actions/setup-go@v2
         with:
           go-version: 1.17
+
       - name: Configure git for private modules
-        run: git config --global url."https://${{ secrets.GIT_USER }}:${{ secrets.GIT_PASSWORD }}@github.com".insteadOf "https://github.com"
+        run: ./hack/setup-git-redirect.sh
+        env:
+          GITHUB_PAT: ${{ secrets.BOT_PAT }}
+
       - name: Lint golang sources
         uses: golangci/golangci-lint-action@v2
         with:
-          version: v1.42
+          version: v1.43
           args: -e S1008
+
   go-test:
     runs-on: [ self-hosted, Linux, X64 ]
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+
       - name: Setup golang
         uses: actions/setup-go@v2
         with:
           go-version: 1.17
+
       - name: Configure git for private modules
-        run: git config --global url."https://${{ secrets.GIT_USER }}:${{ secrets.GIT_PASSWORD }}@github.com".insteadOf "https://github.com"
+        run: ./hack/setup-git-redirect.sh
+        env:
+          GITHUB_PAT: ${{ secrets.BOT_PAT }}
+
       - name: Run tests
         run: make test
+
   kustomize-test:
     runs-on: [ self-hosted, Linux, X64 ]
     steps:
@@ -61,12 +74,21 @@ jobs:
           kustomizationPath: './config/default/'
           kubectl-version: 'latest'
           silent: 'false'
+
   docker-build:
     needs: [ kustomize-test, go-lint, go-test ]
     runs-on: [ self-hosted, Linux, X64 ]
     steps:
       - name: Checkout
         uses: actions/checkout@v2
+
+      - name: Login to Container Registry
+        uses: docker/login-action@v1
+        with:
+          registry: ${{ env.registry }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Get metadata for docker
         uses: docker/metadata-action@v3
         id: meta
@@ -82,24 +104,28 @@ jobs:
             type=sha
           flavor: |
             latest=${{ github.ref == 'refs/heads/main' }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+        with:
+          image: tonistiigi/binfmt:latest
+          platforms: ${{env.platforms}}
+
       - name: Set up Docker Context for Buildx
         id: buildx-context
         run: |
           docker context create builders
+
       - name: Set up Docker Buildx
         timeout-minutes: 5
         uses: docker/setup-buildx-action@v1
         with:
           version: latest
           endpoint: builders
-      - name: Login to Container Registry
-        uses: docker/login-action@v1
-        with:
-          registry: ${{ env.registry }}
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
       - name: Build and push
         uses: docker/build-push-action@v2
+        timeout-minutes: 60
         with:
           context: .
           platforms: ${{ env.platforms }}
@@ -108,5 +134,5 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             GOPRIVATE=github.com/onmetal/*
-            GIT_USER=${{ secrets.GIT_USER }}
-            GIT_PASSWORD=${{ secrets.GIT_PASSWORD }}
+          secrets: |
+            "github_pat=${{ secrets.BOT_PAT }}"

Dockerfile

@@ -1,22 +1,29 @@
 # Build the manager binary
 FROM golang:1.17 as builder
 
+ARG GOARCH
+ARG GOPRIVATE
+
 WORKDIR /workspace
 # Copy the Go Modules manifests
 COPY go.mod go.mod
 COPY go.sum go.sum
 
+COPY hack/ hack/
 # cache deps before building and copying source so that we don't need to re-download as much
 # and so that source changes don't invalidate our downloaded layer
-RUN go mod download
+RUN --mount=type=ssh --mount=type=secret,id=github_pat GITHUB_PAT_PATH=/run/secrets/github_pat ./hack/setup-git-redirect.sh \
+  && mkdir -p -m 0600 ~/.ssh \
+  && ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts \
+  && go mod download
 
 # Copy the go source
 COPY main.go main.go
 COPY api/ api/
 COPY controllers/ controllers/
 
 # Build
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GO111MODULE=on go build -a -o manager main.go
+RUN GOMAXPROCS=1 CGO_ENABLED=0 GOOS=linux GOARCH=${GOARCH} go build -a -o manager main.go
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details

api/v1alpha1/subnet_types.go

@@ -280,32 +280,10 @@ func (in *Subnet) Reserve(cidr *CIDR) error {
 
 // CanReserve checks if it is possible to reserve CIDR
 func (in *Subnet) CanReserve(cidr *CIDR) bool {
-	//for _, vacantCidr := range in.Status.Vacant {
-	//	if vacantCidr.CanReserve(cidr) {
-	//		return true
-	//	}
-	//}
-	l := len(in.Status.Vacant)
-	if l == 0 {
-		return false
-	}
-	start := 0
-	mid := l / 2
-	end := l - 1
-	for start <= end {
-		value := in.Status.Vacant[mid]
-
-		if value.CanReserve(cidr) {
+	for _, vacantCidr := range in.Status.Vacant {
+		if vacantCidr.CanReserve(cidr) {
 			return true
 		}
-
-		if cidr.IsLeft() {
-			end = mid - 1
-			mid = (start + end) / 2
-			continue
-		}
-		start = mid + 1
-		mid = (start + end) / 2
 	}
 	return false
 }

hack/setup-git-redirect.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -e
+
+if [[ -f "$GITHUB_PAT_PATH" ]]; then
+  echo "Sourcing Github pat from path"
+  GITHUB_PAT="$(cat "$GITHUB_PAT_PATH")"
+fi
+
+if [[ "$GITHUB_PAT" != "" ]]; then
+  echo "Rewriting to use Github pat"
+  git config --global url."https://${GITHUB_PAT}:[email protected]/".insteadOf "https://github.com/"
+else
+  echo "No Github pat given, rewriting to use plain ssh auth"
+  git config --global url."[email protected]:".insteadOf "https://github.com"
+fi
+