Un-fork operator-cloud: bring cloud differences behind a runtime Cloud gate

.argoci/config.yaml

@@ -0,0 +1 @@
+version: v2

.argoci/templates/hashrelease/build-hashrelease.yaml

@@ -0,0 +1,189 @@
+apiVersion: argoproj.io/v1alpha1
+kind: WorkflowTemplate
+metadata:
+  name: build-hashrelease
+  namespace: argoci
+  labels:
+    type: cloud-hashrelease
+spec:
+  entrypoint: build-cloud-hashrelease
+  onExit: exit-handler
+  arguments:
+    parameters:
+      - name: hashReleaseURL
+        default: "https://hashrelease-name.docs.eng.tigera.net"
+        description: |
+          Qualified enterprise hashrelease URL produced from the #releases slack channel
+          (eg. https://2023-08-07-master-ducking.docs.eng.tigera.net)
+      - name: operatorBranch
+        default: ""
+        description: |
+          Operator cloud branch to build and push the hashrelease image (eg. master, release-v1.30).
+          Leave blank to parse the operator branch based on hashrelease version file.
+  workflowMetadata:
+    annotations:
+      workflows.argoproj.io/title: "Build HashRelease: {{workflow.parameters.hashReleaseURL}}"
+      workflows.argoproj.io/description: "OperatorBranch: {{workflow.parameters.operatorBranch}}"
+    labels:
+      calicocloud.io/repository: operator
+    labelsFrom:
+      calicocloud.io/hashrelease-url:
+        expression: replace(workflow.parameters.hashReleaseURL, 'https://', '') | replace('/', '') ?? ""
+      calicocloud.io/operator-branch:
+        expression: workflow.parameters.operatorBranch ?? ""
+  templates:
+    - name: build-cloud-hashrelease
+      dag:
+        tasks:
+          - name: build-hashrelease
+            template: build-hashrelease
+
+    - name: build-hashrelease
+      script:
+        image: gcr.io/tigera-cc-dev/ci-base/ubuntu-cloud-providers:v0.93
+        command: [bash]
+        workingDir: "/src"
+        env:
+          - name: USER
+            value: argoci
+          - name: DOCKER_HOST
+            value: tcp://127.0.0.1:2375
+          - name: CI_HOME
+            value: /src
+          - name: CI_GIT_URL
+            value: git@github.com:tigera/operator.git
+          - name: CI_GIT_DIR
+            value: operator
+          - name: CI_GIT_CLONED_BRANCH
+            value: "{{workflow.parameters.operatorBranch}}"
+          - name: HASHRELEASE
+            value: "true"
+          - name: HASHRELEASE_URL
+            value: "{{workflow.parameters.hashReleaseURL}}"
+          - name: CLOUD_REGISTRY
+            value: gcr.io/unique-caldron-775/cnx/
+          # Point enterprise images at the cloud registry (not the quay.io default) so the
+          # hashrelease operator can pull them — otherwise ImagePullBackOff.
+          - name: ENTERPRISE_REGISTRY
+            value: gcr.io/unique-caldron-775/cnx/
+          - name: DEBUG
+            value: "true"
+        volumeMounts:
+          - name: src
+            mountPath: /src
+          - name: go
+            mountPath: /go
+          - name: tmp
+            mountPath: /tmp
+          - name: banzai-secrets-vol
+            mountPath: /secrets
+        envFrom:
+          - secretRef:
+              name: marvin-github-ssh-private-key
+        source: |
+          source checkout
+          echo "[INFO] activating google service account..."
+          gcloud auth activate-service-account --key-file="/secrets/tesla-banzai-google-service-account.json"
+          echo "[INFO] activating docker login"
+          gcloud auth -q configure-docker gcr.io
+          until docker ps; do sleep 5; done # This line waits for the docker sidecar to be ready before continuing
+          make release release-publish VARIANT=cloud
+      sidecars:
+        - name: dind
+          image: docker:24.0.5-dind
+          command: [dockerd-entrypoint.sh]
+          env:
+            - name: DOCKER_TLS_CERTDIR
+              value: ""
+          securityContext:
+            privileged: true
+          mirrorVolumeMounts: true
+      volumes: # NOTE the creation of emptydir volumes here for sharing the files between script and sidecar
+        - name: src
+          emptyDir: {}
+        - name: go
+          emptyDir: {}
+        - name: tmp
+          emptyDir: {}
+        - name: banzai-secrets-vol
+          secret:
+            secretName: tesla-banzai-secrets
+            items:
+              - key: tesla-banzai-google-service-account.json
+                path: tesla-banzai-google-service-account.json
+      outputs:
+        parameters:
+        - name: imageTag
+          valueFrom:
+            path: /tmp/image-tag
+          globalName: imageTag
+        - name: newHashrelease
+          valueFrom:
+            path: /tmp/new-hashrelease
+          globalName: newHashrelease
+
+    - name: exit-handler
+      steps:
+        - - name: notify-releases-slack-channel
+            continueOn:
+              failed: true
+            inline:
+              script:
+                image: gcr.io/tigera-cc-dev/ci-base/ubuntu-cloud-providers:v0.93
+                imagePullPolicy: Always
+                command: [bash]
+                workingDir: "/src"
+                env:
+                  # Slack incoming webhook URL, sourced from a secret rather than hardcoded.
+                  - name: SLACK_WEBHOOK_URL
+                    valueFrom:
+                      secretKeyRef:
+                        name: cloud-hashrelease-slack-webhooks
+                        key: notifications-url
+                source: |
+                  workflow_url="https://argoci.dev.calicocloud.io/workflows/argoci/{{workflow.name}}"
+                  if [ "{{workflow.status}}" == "Succeeded" ]; then
+                    hashrelease_image_url="https://console.cloud.google.com/gcr/images/tigera-cc-dev/GLOBAL/operator-cloud:{{workflow.outputs.parameters.imageTag}}/details"
+                    if [ "{{workflow.outputs.parameters.newHashrelease}}" == "True" ]; then
+                      echo "[INFO] This is a new hashrelease -  {{workflow.outputs.parameters.imageTag}}"
+                      slackMessage=":large_green_square: Successfully built the *<${hashrelease_image_url}|{{workflow.outputs.parameters.imageTag}}>* operator-cloud hashrelease image for hashrelease {{workflow.parameters.hashReleaseURL}}!"
+                    else
+                      echo "[INFO] This is not a new hashrelease -  {{workflow.outputs.parameters.imageTag}}"
+                      slackMessage=":large_green_square: Equivalent cloud hashrelease has already been built previously for enterprise hashrelease {{workflow.parameters.hashReleaseURL}} at *<${hashrelease_image_url}|{{workflow.outputs.parameters.imageTag}}>*."
+                    fi
+                  else
+                    slackMessage="@cloud-hashrelease-maintainers :red_circle: There was an issue building an operator-cloud image for hashrelease {{workflow.parameters.hashReleaseURL}}."
+                    echo "[INFO] Skipped kicking off job to build hashrelease image because workflow status={{workflow.status}}"
+                    echo "[INFO] Workflow Failures:"
+                    echo {{workflow.failures}} | python -m json.tool
+                    errorMessages=`echo {{workflow.failures}} | jq -r '.[] | select(.message != "") | "\t\(.displayName) - \(.message)"'`
+                    slackMessage+="\n*There are errors in these steps:* \n ${errorMessages}"
+                  fi
+
+                  slackTextMessage=$(cat <<EOF
+                  {
+                    "blocks": [
+                      {
+                        "type": "section",
+                        "text": {
+                          "type": "mrkdwn",
+                          "text": "${slackMessage}"
+                        }
+                      },
+                      {
+                        "type": "section",
+                        "text": {
+                          "type": "mrkdwn",
+                          "text": "See the <${workflow_url}|ArgoCI Workflow Job :rocket:> for more details."
+                        }
+                      },
+                      {
+                        "type": "divider"
+                      }
+                    ]
+                  }
+                  EOF
+                  )
+
+                  # Post job status to #bleeding-edge-notifications slack channel
+                  curl -X POST -H 'Content-type: application/json' --data "${slackTextMessage}" "${SLACK_WEBHOOK_URL}"

.gitignore

@@ -103,3 +103,7 @@ ut/
 
 # Logs
 *.log
+
+# Python bytecode caches
+__pycache__/
+*.pyc

.semaphore/push_images_cloud.yml

@@ -0,0 +1,52 @@
+version: v1.0
+name: Operator Cloud CD
+agent:
+  machine:
+    type: f1-standard-2
+    os_image: ubuntu2404
+# Calico Cloud image push pipeline. This coexists with the enterprise push_images.yml: it pushes the
+# operator-cloud image to GCR (VARIANT=cloud, amd64 only) and is promoted only on cloud branches (see
+# semaphore.yml). The enterprise quay/redhat push pipeline is unchanged.
+global_job_config:
+  secrets:
+    - name: docker-hub
+    - name: oss-release-secrets
+    # Mount the github SSH secret for pulling private repositories.
+    - name: private-repo
+  prologue:
+    commands:
+      - echo $DOCKERHUB_PASSWORD | docker login --username "$DOCKERHUB_USERNAME" --password-stdin
+      # Correct permissions since they are too open by default:
+      - chmod 0600 ~/.keys/*
+      # Add the key to the ssh agent:
+      - ssh-add ~/.keys/*
+      # Check out our source code
+      - checkout
+      # Cloud is amd64 only, so only the amd64 caches are needed.
+      - 'cache restore bin-amd64-${SEMAPHORE_GIT_SHA}'
+      - 'cache restore go-pkg-cache-amd64-${SEMAPHORE_GIT_SHA}'
+      - 'cache restore go-mod-cache-amd64-${SEMAPHORE_GIT_SHA}'
+
+blocks:
+  - name: Push Cloud Images
+    task:
+      secrets:
+        - name: google-service-account-for-gcr
+      prologue:
+        commands:
+          - gcloud auth activate-service-account --key-file=/home/semaphore/secrets/secret.google-service-account-key.json
+          - docker login -u _json_key -p "$(cat ~/secrets/secret.google-service-account-key.json)" https://gcr.io
+          - export BRANCH_NAME=$SEMAPHORE_GIT_BRANCH
+      jobs:
+        - name: Build
+          commands:
+            - make cd VARIANT=cloud
+          env_vars:
+            - name: CONFIRM
+              value: "true"
+
+promotions:
+  - name: Clean Up
+    pipeline_file: clean_up.yml
+    auto_promote:
+      when: "result = 'passed'"

.semaphore/release_cloud.yml

@@ -0,0 +1,60 @@
+version: v1.0
+
+name: Operator Cloud Release
+
+execution_time_limit:
+  hours: 4
+
+agent:
+  machine:
+    type: f1-standard-2
+    os_image: ubuntu2404
+
+# Calico Cloud release pipeline. Coexists with the enterprise release.yml: it triggers on cloud-v*
+# tags and publishes the operator-cloud image to GCR via `make release-tag VARIANT=cloud` (one
+# release binary; cloud behavior activates at runtime on VARIANT=cloud). The enterprise v* flow is unchanged.
+global_job_config:
+  secrets:
+    - name: docker-hub
+    - name: oss-release-secrets
+    # Mount the github SSH secret for pulling private repositories.
+    - name: private-repo
+  prologue:
+    commands:
+      - echo $DOCKERHUB_PASSWORD | docker login --username "$DOCKERHUB_USERNAME" --password-stdin
+      # Correct permissions since they are too open by default:
+      - chmod 0600 ~/.keys/*
+      # Add the key to the ssh agent:
+      - ssh-add ~/.keys/*
+      # Check out our source code
+      - checkout
+      # Cloud is amd64 only, so only the amd64 caches are needed.
+      - "cache restore bin-amd64-${SEMAPHORE_GIT_SHA}"
+      - "cache restore go-pkg-cache-amd64-${SEMAPHORE_GIT_SHA}"
+      - "cache restore go-mod-cache-amd64-${SEMAPHORE_GIT_SHA}"
+
+blocks:
+  - name: Release Cloud
+    run:
+      when: "tag =~ '^cloud-v'"
+    task:
+      secrets:
+        - name: google-service-account-for-gcr
+      prologue:
+        commands:
+          - gcloud auth activate-service-account --key-file=/home/semaphore/secrets/secret.google-service-account-key.json
+          - docker login -u _json_key -p "$(cat ~/secrets/secret.google-service-account-key.json)" https://gcr.io
+          - export BRANCH_NAME=$SEMAPHORE_GIT_BRANCH
+      jobs:
+        - name: Publish Cloud Release
+          commands:
+            - make release-tag VARIANT=cloud RELEASE_TAG=${SEMAPHORE_GIT_TAG_NAME}
+          env_vars:
+            - name: CONFIRM
+              value: "true"
+
+promotions:
+  - name: Clean Up
+    pipeline_file: clean_up.yml
+    auto_promote:
+      when: "result = 'passed'"

.semaphore/semaphore.yml

@@ -196,3 +196,14 @@ promotions:
   - name: Clear Cache
     # Never auto promote this, this is only to give an easy way for people to clear the cache.
     pipeline_file: clear_cache.yml
+  # Calico Cloud promotions (additive — the enterprise promotions above are unchanged). These push
+  # the operator-cloud image to GCR alongside the enterprise quay push, and run only on cloud
+  # conditions. The cloud pipelines build amd64-only via VARIANT=cloud.
+  - name: Push Cloud Images
+    pipeline_file: push_images_cloud.yml
+    auto_promote:
+      when: "(branch =~ 'master|staging|release-.*') AND (result = 'passed')"
+  - name: Release Cloud
+    pipeline_file: release_cloud.yml
+    auto_promote:
+      when: "result = 'passed' AND tag =~ '^cloud-v'"