Skip to content

Commit e0ea453

Browse files
dkoshkinjimmidyson
dkoshkin
authored and
jimmidyson
committed
build: copy example from upstream
1 parent 3031f63 commit e0ea453

15 files changed

+398
-0
lines changed

‎Dockerfile

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# syntax=docker/dockerfile:1.4
2+
3+
# Copyright 2022 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# Build the extension binary
18+
# Run this with docker build --build-arg builder_image=<golang:x.y.z>
19+
ARG builder_image
20+
21+
# Ignore Hadolint rule "Always tag the version of an image explicitly."
22+
# It's an invalid finding since the image is explicitly set in the Makefile.
23+
# https://github.com/hadolint/hadolint/wiki/DL3006
24+
# hadolint ignore=DL3006
25+
FROM ${builder_image} as builder
26+
WORKDIR /workspace
27+
28+
# Run this with docker build --build-arg goproxy=$(go env GOPROXY) to override the goproxy
29+
ARG goproxy=https://proxy.golang.org
30+
# Run this with docker build --build-arg package=./controlplane/kubeadm or --build-arg package=./bootstrap/kubeadm
31+
ENV GOPROXY=$goproxy
32+
33+
# Copy the Go Modules manifests
34+
COPY go.mod go.mod
35+
COPY go.sum go.sum
36+
37+
# Cache deps before building and copying source so that we don't need to re-download as much
38+
# and so that source changes don't invalidate our downloaded layer
39+
RUN --mount=type=cache,target=/go/pkg/mod \
40+
go mod download
41+
42+
# Copy the sources
43+
COPY ./ ./
44+
45+
# Cache the go build into the the Go’s compiler cache folder so we take benefits of compiler caching across docker build calls
46+
RUN --mount=type=cache,target=/root/.cache/go-build \
47+
--mount=type=cache,target=/go/pkg/mod \
48+
go build .
49+
50+
# Build
51+
ARG package=.
52+
ARG ARCH
53+
ARG ldflags
54+
55+
# Essentially, change directories into test extension
56+
WORKDIR /workspace/test/extension
57+
58+
# Do not force rebuild of up-to-date packages (do not use -a) and use the compiler cache folder
59+
RUN --mount=type=cache,target=/root/.cache/go-build \
60+
--mount=type=cache,target=/go/pkg/mod \
61+
CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} \
62+
go build -trimpath -ldflags "${ldflags} -extldflags '-static'" \
63+
-o /workspace/extension ${package}
64+
65+
# Production image
66+
FROM gcr.io/distroless/static:nonroot
67+
WORKDIR /
68+
COPY --from=builder /workspace/extension .
69+
# Use uid of nonroot user (65532) because kubernetes expects numeric user when applying pod security policies
70+
USER 65532
71+
ENTRYPOINT ["/extension"]

‎config/certmanager/certificate.yaml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# The following manifests contain a self-signed issuer CR and a certificate CR.
2+
# More document can be found at https://docs.cert-manager.io
3+
apiVersion: cert-manager.io/v1
4+
kind: Issuer
5+
metadata:
6+
name: selfsigned-issuer
7+
spec:
8+
selfSigned: { }
9+
---
10+
apiVersion: cert-manager.io/v1
11+
kind: Certificate
12+
metadata:
13+
name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml
14+
spec:
15+
# $(SERVICE_NAME) will be substituted by kustomize
16+
# $(SERVICE_NAMESPACE) will be substituted on deployment
17+
dnsNames:
18+
- $(SERVICE_NAME).${SERVICE_NAMESPACE}.svc
19+
- $(SERVICE_NAME).${SERVICE_NAMESPACE}.svc.cluster.local
20+
# for local testing.
21+
- localhost
22+
issuerRef:
23+
kind: Issuer
24+
name: selfsigned-issuer
25+
secretName: $(SERVICE_NAME)-cert # this secret will not be prefixed, since it's not managed by kustomize
26+
subject:
27+
organizations:
28+
- k8s-sig-cluster-lifecycle

‎config/certmanager/kustomization.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
resources:
4+
- certificate.yaml
5+
6+
configurations:
7+
- kustomizeconfig.yaml

‎config/certmanager/kustomizeconfig.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# This configuration is for teaching kustomize how to update name ref and var substitution
2+
nameReference:
3+
- kind: Issuer
4+
group: cert-manager.io
5+
fieldSpecs:
6+
- kind: Certificate
7+
group: cert-manager.io
8+
path: spec/issuerRef/name
9+
10+
varReference:
11+
- kind: Certificate
12+
group: cert-manager.io
13+
path: spec/commonName
14+
- kind: Certificate
15+
group: cert-manager.io
16+
path: spec/dnsNames
17+
- kind: Certificate
18+
group: cert-manager.io
19+
path: spec/secretName

‎config/default/extension.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: test-extension
6+
spec:
7+
selector:
8+
matchLabels:
9+
app: test-extension
10+
replicas: 1
11+
template:
12+
metadata:
13+
labels:
14+
app: test-extension
15+
spec:
16+
containers:
17+
- command:
18+
- /extension
19+
image: controller:latest
20+
name: extension
21+
terminationGracePeriodSeconds: 10
22+
serviceAccountName: test-extension
23+
tolerations:
24+
- effect: NoSchedule
25+
key: node-role.kubernetes.io/master
26+
- effect: NoSchedule
27+
key: node-role.kubernetes.io/control-plane

‎config/default/extension_image_patch.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: test-extension
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- image: gcr.io/k8s-staging-cluster-api/test-extension:main
10+
name: extension

‎config/default/extension_pull_policy.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: test-extension
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: extension
10+
imagePullPolicy: Always

‎config/default/extension_webhook_patch.yaml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: test-extension
5+
spec:
6+
template:
7+
spec:
8+
containers:
9+
- name: extension
10+
ports:
11+
- containerPort: 9443
12+
name: webhook-server
13+
protocol: TCP
14+
volumeMounts:
15+
- mountPath: /tmp/k8s-webhook-server/serving-certs
16+
name: cert
17+
readOnly: true
18+
volumes:
19+
- name: cert
20+
secret:
21+
secretName: $(SERVICE_NAME)-cert

‎config/default/kustomization.yaml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
commonLabels:
2+
3+
resources:
4+
- extension.yaml
5+
- service.yaml
6+
- role.yaml
7+
- rolebinding.yaml
8+
- service_account.yaml
9+
10+
bases:
11+
- ../certmanager
12+
13+
patchesStrategicMerge:
14+
# Provide customizable hook for make targets.
15+
- extension_image_patch.yaml
16+
- extension_pull_policy.yaml
17+
# Enable webhook.
18+
- extension_webhook_patch.yaml
19+
20+
vars:
21+
- name: SERVICE_NAME
22+
objref:
23+
kind: Service
24+
version: v1
25+
name: webhook-service
26+
27+
configurations:
28+
- kustomizeconfig.yaml

‎config/default/kustomizeconfig.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# This configuration is for teaching kustomize how to update name ref and var substitution
2+
varReference:
3+
- kind: Deployment
4+
path: spec/template/spec/volumes/secret/secretName

‎config/default/role.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: Role
3+
metadata:
4+
name: test-extension
5+
rules:
6+
- apiGroups:
7+
- ""
8+
resources:
9+
- configmaps
10+
verbs:
11+
- get
12+
- list
13+
- watch
14+
- patch
15+
- update
16+
- create

‎config/default/rolebinding.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: RoleBinding
3+
metadata:
4+
name: test-extension
5+
roleRef:
6+
apiGroup: rbac.authorization.k8s.io
7+
kind: Role
8+
name: test-extension
9+
subjects:
10+
- kind: ServiceAccount
11+
name: test-extension
12+
namespace: ${SERVICE_NAMESPACE}

‎config/default/service.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: webhook-service
5+
spec:
6+
ports:
7+
- port: 443
8+
targetPort: webhook-server
9+
selector:
10+
app: test-extension

‎config/default/service_account.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: test-extension

0 commit comments

Comments
 (0)