diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index bd57ea309..bc03f0fab 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -131,43 +131,51 @@ jobs: $(go env GOPATH)/bin/ziti-ci trigger-jenkins-smoke-build - name: Set up QEMU + if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-v') uses: docker/setup-qemu-action@master with: platforms: amd64,arm64,arm - name: Set up Docker BuildKit + if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-v') id: buildx uses: docker/setup-buildx-action@master - name: Login to Docker Hub + if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-v') uses: docker/login-action@v1 with: username: ${{ secrets.DOCKER_HUB_API_USER }} password: ${{ secrets.DOCKER_HUB_API_TOKEN }} - name: Set up Docker image tags + if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-v') env: SNAPSHOT_REPO: openziti/ziti-tunnel RELEASE_REPO: netfoundry/ziti-tunnel id: tagprep run: | - # If this is release tag then add the release repo and semver and "latest" to the list of tags - BRANCH_REF="${GITHUB_HEAD_REF:-${GITHUB_REF}}" - TAGS="" - if [[ "${BRANCH_REF}" =~ refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then - # drop the prefix, preserving the semver - REF_TAG=${BRANCH_REF#refs/tags/v} - for REPO in ${SNAPSHOT_REPO} ${RELEASE_REPO}; do - TAGS+=",${REPO}:${REF_TAG},${REPO}:latest" - done - else - REF_TAG="$(sed -E 's/[^a-zA-Z0-9]/-/g;s/(^[^a-zA-Z0-9]+|[^a-zA-Z0-9]+$)//g' <<< "${BRANCH_REF}" | tr '[:upper:]' '[:lower:]')" - TAGS+="${SNAPSHOT_REPO}:${REF_TAG}" - fi - TAGS=${TAGS#,} # drop leading comma char - # Set output parameters. - echo ::set-output name=tags::${TAGS} + # the Docker cross-build only runs on branches main or release-v* + # where ziti-ci always computes and pushes a new release tag + ZITI_VERSION="$($(go env GOPATH)/bin/ziti-ci -q get-current-version)" + # drop the leaving "v" char, if any + ZITI_VERSION=${ZITI_VERSION#v} + DOCKER_TAGS="" + if [[ "${ZITI_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + for REPO in ${SNAPSHOT_REPO} ${RELEASE_REPO}; do + DOCKER_TAGS+=",${REPO}:${ZITI_VERSION},${REPO}:latest" + done + else + # fail the job because we could not obtain the current version from ziti-ci + exit 1 + fi + DOCKER_TAGS=${DOCKER_TAGS#,} # drop leading comma char, if exists + # Set output parameters. + echo "DEBUG: DOCKER_TAGS=${DOCKER_TAGS}" + echo ::set-output name=tags::${DOCKER_TAGS} + - name: Build & Push Multi-Platform Container Image to Hub + if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-v') uses: docker/build-push-action@v2 with: builder: ${{ steps.buildx.outputs.name }} diff --git a/ziti-tunnel/docker/Dockerfile b/ziti-tunnel/docker/Dockerfile index 0119cbdc8..9071733db 100644 --- a/ziti-tunnel/docker/Dockerfile +++ b/ziti-tunnel/docker/Dockerfile @@ -1,4 +1,4 @@ -FROM debian:stable-slim as fetch-ziti-artifacts +FROM debian:buster-slim as fetch-ziti-artifacts # This build stage grabs artifacts that are copied into the final image. # It uses the same base as the final image to maximize docker cache hits. @@ -25,12 +25,10 @@ RUN bash ./fetch-ziti-bins.sh ziti-tunnel # ################ -FROM debian:stable-slim +FROM debian:buster-slim RUN mkdir -p /usr/local/bin /etc/ssl/certs RUN apt-get -q update && apt-get -q install -y --no-install-recommends iptables -# Use 32-bit arm binaries on arm64 until we have 64-bit arm builds. This also affects fetch-ziti-bins.sh. -RUN if [ "$(uname -m)" = "aarch64" ]; then dpkg --add-architecture armhf; apt update; apt install -y libc6:armhf; fi COPY --from=fetch-ziti-artifacts /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs COPY --from=fetch-ziti-artifacts /tmp/ziti-tunnel /usr/local/bin COPY ./docker-entrypoint.sh / diff --git a/ziti-tunnel/docker/Dockerfile.copy b/ziti-tunnel/docker/Dockerfile.copy index 082e42b86..b75fb84ad 100644 --- a/ziti-tunnel/docker/Dockerfile.copy +++ b/ziti-tunnel/docker/Dockerfile.copy @@ -1,4 +1,4 @@ -FROM debian:stable-slim as fetch-ziti-artifacts +FROM debian:buster-slim as fetch-ziti-artifacts # This build stage grabs artifacts that are copied into the final image. # It uses the same base as the final image to maximize docker cache hits. @@ -25,15 +25,13 @@ COPY ${ARTIFACTS_DIR}/${TARGETARCH}/${TARGETOS}/ziti-tunnel . # ################ -FROM debian:stable-slim +FROM debian:buster-slim ARG DOCKER_BUILD_DIR=. ARG ZITI_TUNNELER_BIN=ziti-tunnel RUN mkdir -p /usr/local/bin /etc/ssl/certs RUN apt-get -q update && apt-get -q install -y --no-install-recommends iptables -# Use 32-bit arm binaries on arm64 until we have 64-bit arm builds. This also affects fetch-ziti-bins.sh. -RUN if [ "$(uname -m)" = "aarch64" ]; then dpkg --add-architecture armhf; apt update; apt install -y libc6:armhf; fi COPY --from=fetch-ziti-artifacts /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs COPY --from=fetch-ziti-artifacts /tmp/${ZITI_TUNNELER_BIN} /usr/local/bin COPY ${DOCKER_BUILD_DIR}/docker-entrypoint.sh / diff --git a/ziti-tunnel/docker/buildx.sh b/ziti-tunnel/docker/buildx.sh index 5315a318a..a36eadb02 100755 --- a/ziti-tunnel/docker/buildx.sh +++ b/ziti-tunnel/docker/buildx.sh @@ -33,7 +33,7 @@ EOF BASENAME=$(basename "$0") || exit $? DIRNAME=$(dirname "$0") || exit $? -while getopts :c:hPr: OPT;do +while getopts :chPr: OPT;do case $OPT in c) FLAGS+=$OPT # don't checkout vZITI_VERSION ;; @@ -65,18 +65,25 @@ else git checkout "v${ZITI_VERSION}" fi -docker run --rm --privileged docker/binfmt:a7996909642ee92942dcd6cff44b9b95f08dad64 +docker run --rm --privileged linuxkit/binfmt:v0.8 grep -E -q enabled /proc/sys/fs/binfmt_misc/qemu-arm -docker run --rm arm64v8/alpine uname -a|grep -E -q 'aarch64 Linux' -docker run --rm arm32v7/alpine uname -a|grep -E -q 'armv7l Linux' +docker run --rm --platform arm arm32v7/alpine uname -a|grep -E -q 'armv7l Linux' +docker run --rm --platform arm64 arm64v8/alpine uname -a|grep -E -q 'aarch64 Linux' docker buildx create --use --name=ziti-builder 2>/dev/null || docker buildx use --default ziti-builder -docker buildx build "$DIRNAME" \ +# if default then push to Hub +BUILDX_OUTPUT="--push" +if [[ ${FLAGS:-} =~ P ]]; then + # if no push then load in image cache + BUILDX_OUTPUT="" +fi + +eval docker buildx build "$DIRNAME" \ --platform linux/amd64,linux/arm/v7,linux/arm64 \ --build-arg "ZITI_VERSION=${ZITI_VERSION}" \ --tag "${CONTAINER_REPO}:${ZITI_VERSION}" \ --tag "${CONTAINER_REPO}:latest" \ - --push + "${BUILDX_OUTPUT:-}" docker buildx stop ziti-builder diff --git a/ziti-tunnel/docker/fetch-ziti-bins.sh b/ziti-tunnel/docker/fetch-ziti-bins.sh index deedb83d0..a0ed986c1 100755 --- a/ziti-tunnel/docker/fetch-ziti-bins.sh +++ b/ziti-tunnel/docker/fetch-ziti-bins.sh @@ -30,7 +30,8 @@ echo "Fetching from Artifactory." host_arch=$(uname -m) case "${host_arch}" in "x86_64") artifact_arch="amd64";; -"armv7l"|"aarch64") artifact_arch="arm";; +"armv7l") artifact_arch="arm";; +"aarch64") artifact_arch="arm64";; *) echo "ERROR: ziti binaries do not exist for architecture ${host_arch}"; exit 1;; esac