Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: set quay image expiry to prevent overflow of images #212

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat: set quay image expiry to prevent overflow of images #212

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 23 additions & 16 deletions .github/workflows/build-images.yaml → .github/workflows/build-images-base.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,20 @@
name: Build and push images

on:
push:
branches:
- 'main'
- 'master'
workflow_call:
inputs:
authorinoVersion:
description: Authorino version
required: true
default: latest
channels:
description: Bundle and catalog channels, comma separated
required: true
default: stable
quayImageExpiry:
description: When to expire the built quay images. The time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively, from the time the image is built.
default: never
type: string
workflow_dispatch:
inputs:
authorinoVersion:
Expand All @@ -15,15 +25,19 @@ on:
description: Bundle and catalog channels, comma separated
required: true
default: stable
quayImageExpiry:
description: When to expire the built quay images. The time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively, from the time the image is built.
default: never
type: string

env:
IMG_TAGS: ${{ github.sha }}
IMG_TAGS: ${{ inputs.authorinoVersion }}
IMG_REGISTRY_HOST: quay.io
IMG_REGISTRY_ORG: kuadrant
MAIN_BRANCH_NAME: main
OPERATOR_NAME: authorino-operator
BUILD_CONFIG_FILE: build.yaml
LATEST_AUTHORINO_GITREF: ${{ vars.AUTHORINO_SHA != '' && vars.AUTHORINO_SHA || 'latest' }}
QUAY_IMAGE_EXPIRY: ${{ inputs.quayImageExpiry }}

jobs:
build:
Expand All @@ -32,16 +46,6 @@ jobs:
steps:
- name: Check out code
uses: actions/checkout@v3
- name: Add latest tag
if: ${{ github.ref_name == env.MAIN_BRANCH_NAME }}
id: add-latest-tag
run: |
echo "IMG_TAGS=latest ${{ env.IMG_TAGS }}" >> $GITHUB_ENV
- name: Add branch tag
if: ${{ github.ref_name != env.MAIN_BRANCH_NAME }}
id: add-branch-tag
run: |
echo "IMG_TAGS=${GITHUB_REF_NAME/\//-} ${{ env.IMG_TAGS }}" >> $GITHUB_ENV
Comment on lines -35 to -44
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this really what we want? This will break with the single manifest link between builds.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see how we can add the expire label for different types of builds unless we do this since latest & SHA builds are usually the same on merge to main.

Branch + SHA build would only happen if the workflow is triggered manually currently.

- name: Set Operator version
id: operator-version
run: |
Expand Down Expand Up @@ -69,6 +73,7 @@ jobs:
GIT_SHA=${{ github.sha }}
DIRTY=false
DEFAULT_AUTHORINO_IMAGE=${{ env.DEFAULT_AUTHORINO_IMAGE }}
QUAY_IMAGE_EXPIRY=${{ inputs.quayImageExpiry }}
containerfiles: |
./Dockerfile
- name: Push Image
Expand Down Expand Up @@ -143,6 +148,7 @@ jobs:
platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
build-args: |
version=${{ env.VERSION }}
QUAY_IMAGE_EXPIRY=${{ inputs.quayImageExpiry }}
containerfiles: |
./bundle.Dockerfile
- name: Push Image
Expand Down Expand Up @@ -225,6 +231,7 @@ jobs:
context: ./catalog
dockerfiles: |
./catalog/${{ env.OPERATOR_NAME }}-catalog.Dockerfile
# The Quay image expiry label for the generated catalog Dockerfile is set via opm, using the value set in the QUAY_IMAGE_EXPIRY environment variable
- name: Push Image
if: ${{ !env.ACT }}
id: push-to-quay
Expand Down
14 changes: 14 additions & 0 deletions .github/workflows/build-images-main-sha.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
name: Build SHA image for main branch

on:
push:
branches: ['main']

jobs:
workflow-build:
name: Calls build-images-base workflow
uses: ./.github/workflows/build-images-base.yaml
secrets: inherit
with:
authorinoVersion: ${{ github.sha }}
quayImageExpiry: 2w
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm making an assumption that SHA build are equivalent to nightly builds that we want to expire 🤔

If anyone has a better expiry value, I can update this

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Until now, SHA builds have not been equivalent to nightly builds. As of today, builds are tagged additionally with the commit SHA on top of the other, more human-friendly tag. This includes latest (for main branch), feature branches, and long-lived release builds.

I'm not sure how I feel about breaking this link between tags, effectively building two separate images now, if this is only for the purpose of cleaning up the registry.

The quay.expires-after label seems easy enough, but it only works for expiring an entire image, not an individual image tag.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, I guess the question is then, does authorino-operator images need / want to expire images through this label? To me, it seems like it may not since the current workflow triggers on merge to main, which would build with an equivalent SHA tag. These SHA tags are kept indefinitely, but maybe that is something we want.

Feature branch and release builds looks to require manual trigger of the same workflow which do not happen that regularly

11 changes: 11 additions & 0 deletions .github/workflows/build-images-main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
name: Build latest image for main branch

on:
push:
branches: ['main']

jobs:
workflow-build:
name: Calls build-images-base workflow
uses: ./.github/workflows/build-images-base.yaml
secrets: inherit
5 changes: 5 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,4 +30,9 @@ WORKDIR /
COPY --from=builder /workspace/manager .
USER 1001

# Quay image expiry
ARG QUAY_IMAGE_EXPIRY
ENV QUAY_IMAGE_EXPIRY=${QUAY_IMAGE_EXPIRY:-never}
LABEL quay.expires-after=$QUAY_IMAGE_EXPIRY

ENTRYPOINT ["/manager"]
6 changes: 4 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,7 +225,7 @@ run: manifests generate fmt vet ## Run a controller from your host.
docker-build: GIT_SHA=$(shell git rev-parse HEAD || echo "unknown")
docker-build: DIRTY=$(shell $(PROJECT_DIR)/utils/check-git-dirty.sh || echo "unknown")
docker-build: ## Build docker image with the manager.
docker build --build-arg VERSION=$(VERSION) --build-arg GIT_SHA=$(GIT_SHA) --build-arg DIRTY=$(DIRTY) --build-arg ACTUAL_DEFAULT_AUTHORINO_IMAGE=$(ACTUAL_DEFAULT_AUTHORINO_IMAGE) -t $(OPERATOR_IMAGE) .
docker build --build-arg VERSION=$(VERSION) --build-arg GIT_SHA=$(GIT_SHA) --build-arg DIRTY=$(DIRTY) --build-arg ACTUAL_DEFAULT_AUTHORINO_IMAGE=$(ACTUAL_DEFAULT_AUTHORINO_IMAGE) --build-arg QUAY_IMAGE_EXPIRY=$(QUAY_IMAGE_EXPIRY) -t $(OPERATOR_IMAGE) .

docker-push: ## Push docker image with the manager.
docker push ${OPERATOR_IMAGE}
Expand Down Expand Up @@ -311,11 +311,13 @@ bundle-custom-modifications:
# Set Openshift version in bundle Dockerfile
@echo "" >> bundle.Dockerfile
@echo "# Custom labels" >> bundle.Dockerfile
# Quay image expiry label
@echo "$$QUAY_EXPIRY_TIME_LABEL" >> bundle.Dockerfile
@echo "LABEL $(OPENSHIFT_VERSIONS_ANNOTATION_KEY)=$(OPENSHIFT_SUPPORTED_VERSIONS)" >> bundle.Dockerfile

.PHONY: bundle-build
bundle-build: ## Build the bundle image.
docker build -f bundle.Dockerfile -t $(BUNDLE_IMG) .
docker build --build-arg QUAY_IMAGE_EXPIRY=$(QUAY_IMAGE_EXPIRY) -f bundle.Dockerfile -t $(BUNDLE_IMG) .

.PHONY: bundle-push
bundle-push: ## Push the bundle image.
Expand Down
4 changes: 4 additions & 0 deletions bundle.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,4 +20,8 @@ COPY bundle/metadata /metadata/
COPY bundle/tests/scorecard /tests/scorecard/

# Custom labels
## Quay image expiry
ARG QUAY_IMAGE_EXPIRY
ENV QUAY_IMAGE_EXPIRY=${QUAY_IMAGE_EXPIRY:-never}
LABEL quay.expires-after=${QUAY_IMAGE_EXPIRY}
LABEL com.redhat.openshift.versions=v4.12
14 changes: 13 additions & 1 deletion make/catalog.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,21 @@ CATALOG_IMG ?= $(IMAGE_TAG_BASE)-catalog:$(IMAGE_TAG)
CATALOG_FILE = $(PROJECT_DIR)/catalog/authorino-operator-catalog/operator.yaml
CATALOG_DOCKERFILE = $(PROJECT_DIR)/catalog/authorino-operator-catalog.Dockerfile

# Quay image default expiry
QUAY_IMAGE_EXPIRY ?= never

# A LABEL that can be appended to a generated Dockerfile to set the Quay image expiration through Docker arguments.
define QUAY_EXPIRY_TIME_LABEL
## Quay image expiry
ARG QUAY_IMAGE_EXPIRY
ENV QUAY_IMAGE_EXPIRY=$${QUAY_IMAGE_EXPIRY:-never}
LABEL quay.expires-after=$${QUAY_IMAGE_EXPIRY}
endef
export QUAY_EXPIRY_TIME_LABEL

$(CATALOG_DOCKERFILE): $(OPM)
-mkdir -p $(PROJECT_DIR)/catalog/authorino-operator-catalog
cd $(PROJECT_DIR)/catalog && $(OPM) generate dockerfile authorino-operator-catalog
cd $(PROJECT_DIR)/catalog && $(OPM) generate dockerfile authorino-operator-catalog -l quay.expires-after=$(QUAY_IMAGE_EXPIRY)
catalog-dockerfile: $(CATALOG_DOCKERFILE) ## Generate catalog dockerfile.

$(CATALOG_FILE): $(OPM) $(YQ)
Expand Down
Loading