Commit Graph

126 Commits

Author SHA1 Message Date
renovate[bot]
0b5c162f2a Update aquasec/trivy Docker tag to v0.39.0 (#1236)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-04-03 11:08:35 +02:00
Mauro Morales
e5dae4e9c4 arrow_up: Bump go in Earthly and workflows to ^1.20 (#1213)
* Bump go in Earthly and workflows to ^1.20

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

* Update go.mod version

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

* Lint

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

* Remove pin of go version to get the latest

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

* Remove minor version

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

---------

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>
2023-03-30 16:42:25 +02:00
Mauro Morales
77697af24f bug: Pass version to build of kairos agent (#1205)
Pass version to build of kairos agent

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>
2023-03-28 20:09:57 +02:00
Itxaka
09c6ed1538 bug: Fix validator on long strings (#1194)
* 🐛 Fix validator on long strings

Validator was mistakenly identifying a long yaml as a file and trying to
open it, which failed with an error of filename too long.

This was not catched in order to identify that the source is not a file
but a yaml, so it was directly returning the error.

This patch adds that error to the list in order ot identify the source
to validate as yaml. Also adds a couple of tests for this functionality.

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

* 🐛 Merge initramfs generation between distros

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

---------

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-03-28 18:20:56 +02:00
Itxaka
90ddda716e robot: Move repo bump to earthly (#1183)
Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-03-23 15:28:56 +01:00
Itxaka
1fc9a53e19 robot: Improve golang CI runs (#1165) 2023-03-17 16:45:43 +01:00
Itxaka
bd20a74349 sparkles: Use kairos-sdk module (#1140) 2023-03-15 15:45:00 +01:00
renovate[bot]
a406cd83fe Update aquasec/trivy Docker tag to v0.38.3 (#1096)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-03-14 13:19:17 +01:00
renovate[bot]
16ed6c2e1a Update quay.io/kairos/osbuilder-tools Docker tag to v0.5.3 (#1095)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-03-14 10:40:10 +01:00
renovate[bot]
dfc3cc48ea Update renovate/renovate Docker tag to v35 (#1105)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-03-14 10:39:28 +01:00
Ettore Di Giacinto
b2d6fc5d7e robot: Various enhancement to security scans (#1100)
* 🤖 Add --add-cpes-if-none to grype

Signed-off-by: mudler <mudler@c3os.io>

* 🤖 Remove dup

Signed-off-by: mudler <mudler@c3os.io>

* 🤖 Scan from base-image

Signed-off-by: mudler <mudler@c3os.io>

* 🤖 Move ARGs where are needed

Signed-off-by: mudler <mudler@c3os.io>

---------

Signed-off-by: mudler <mudler@c3os.io>
2023-03-10 18:11:48 +01:00
Ettore Di Giacinto
199f7fff43 robot: Fixup trivy scans (#1093)
* 🐧 Delete any files dangling in /tmp

Signed-off-by: mudler <mudler@c3os.io>

* 🤖 Skip /tmp scan in trivy

Signed-off-by: mudler <mudler@c3os.io>

---------

Signed-off-by: mudler <mudler@c3os.io>
2023-03-10 14:28:14 +01:00
Ettore Di Giacinto
2b87d05def robot: Pin trivy version (#1090)
Fixes: #1087

Signed-off-by: mudler <mudler@c3os.io>
2023-03-10 10:21:32 +01:00
Itxaka
6ded118d76 robot: Update immucore dev testing (#1059)
There is now less files to copy over

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-03-09 18:57:00 +01:00
Jacob Payne
5537ee1062 added zfs tests
Signed-off-by: Jacob Payne <jacob@spectrocloud.com>
2023-01-25 15:58:08 -07:00
Jacob Payne
dffbd9f327 added zfs packages to all images
Signed-off-by: Jacob Payne <jacob@spectrocloud.com>
2023-01-18 09:15:35 -07:00
Ettore Di Giacinto
557941fe55 robot: Add grype scan reports (#1057)
Signed-off-by: mudler <mudler@c3os.io>
2023-03-08 09:13:08 +01:00
Ettore Di Giacinto
ca7576c1fe robot: Fixup test targets (#1034)
We were listing on a dir that now doesn't exist necessarly anymore, and
when picking up the iso from latest release, we are selectively
pickingone flavor for the upgrade test.

Signed-off-by: mudler <mudler@c3os.io>
2023-03-03 23:27:41 +01:00
Dimitris Karakasilis
c0afc41fe4 Point ginkgo to the absolute path of the iso
Signed-off-by: Dimitris Karakasilis <dimitris@karakasilis.me>
2023-03-03 20:42:49 +02:00
Dimitris Karakasilis
bd2dcd9300 Stop deleting the .earthlyignore and use PREBUILT_ISO ARG instead
Signed-off-by: Ettore Di Giacinto <ettore@spectrocloud.com>
2023-03-03 17:48:20 +02:00
Ettore Di Giacinto
ed7f6c989f Fix bundle tests
The `rm` we did, made the repo "dirty" thus changing the kubo extention
version. This result in a kubo version that doesn't match the one in
/etc/os-release, so systemd-sysext doesn't show the extension.

https://www.freedesktop.org/software/systemd/man/systemd-sysext.html#Options

Fixes: https://github.com/kairos-io/kairos/issues/1029

Signed-off-by: Dimitris Karakasilis <dimitris@spectrocloud.com>
2023-03-03 15:54:32 +02:00
Ettore Di Giacinto
5419e568cc seedling: Make sure to remove generated keys during setup (#1027)
Signed-off-by: mudler <mudler@c3os.io>
2023-03-03 13:57:43 +01:00
Ettore Di Giacinto
ae917ce581 robot: Attach trivy scan reports (#1019)
Signed-off-by: mudler <mudler@c3os.io>
2023-03-02 18:37:00 +01:00
Ettore Di Giacinto
ace91a321c robot: Use VARIANT, output SBOM to build (#1017)
🤖 Use VARIANT, output to build

Signed-off-by: mudler <mudler@c3os.io>
2023-03-02 16:47:52 +01:00
Itxaka
11f1c542a5 robot: Allow testing immucore from branches (#989)
Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-03-02 15:46:15 +01:00
Itxaka
fb3bb69a62 robot: Fix some tests rebuilding the iso (#980) 2023-03-02 14:29:40 +01:00
Ettore Di Giacinto
8759d62259 robot: Add SBOM artifacts to CI pipelines (#998)
* 🤖 Add image-sbom target

Signed-off-by: mudler <mudler@c3os.io>

* 🤖 Add image-sbom to main targets

Signed-off-by: mudler <mudler@c3os.io>

* 🤖 Add SBOM artifacts to pipelines

Signed-off-by: mudler <mudler@c3os.io>

---------

Signed-off-by: mudler <mudler@c3os.io>
2023-03-02 09:43:30 +01:00
Itxaka
b6bd105880 warning: 🎨 Use immucore 🦔 (#877)
* ⚠️ 🎨  Use immucore

Build kairos with immmucore instead of cos-immutable-rootfs

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

* 🐛 Fix state sdk

State sdk is using ghw to identify the state of the disks, but
unfortunately ghw only works with devices and not with labels

This patch adds a workaround by checking deeper for partitions that
migth not have mountpoints reported by ghw but are indeed mounted

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

* 🐛 Fix state not catching netboot properly

This worked with the old cos-immutable-rootfs due to the rd.cos.disable
stanza in cmdline making the livecd cloud config file trigger, which
created the livecd sentinel file.

With immucore, the sentinel is being created during initramfs directly
so we need to rely on the cmdline to identify it.

State sdk should know that having the netboot stanza should identify the
boot as cdlive

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

* Fix custom binds set as RW_PATHS

RW_PATHS are meant for overlay dirs which go away after a reboot.
Custom binds/binds are mounted under COS_PERSISTENT, so they persist
after reboot AND are RW by default.

This patch removes adding the custom binds into the RW_PATHS on the
cos-layout file as that can lead to unintended consequences

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

* Dont run custom mounts on livecd and recovery

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

* Rework writing custom ephemeral/binds

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

* Maybe fix tests

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

* Add missing sgdisk to ubuntu images

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

* 🐛 Backport dracut patch for ubuntu 20 iscsi

There was an issue with dracut 48 in which the iscsid.socket required fs
targets to be ready. On an iso this could lead to a dependency cycle
between the dmsquash module setting up the livecd rootfs and the iscsi
socket required the initrd-fs to be ready.

This was fixed on dracut 50 and its what this patch brings, dropping the
socket dependency on the fs target so it can break the dependency cycle.

This only affect ubuntu 20 lts, and only affects booting from the iso.
Alos the issue is random as systemd will decide to break the dependency
in a non predictable way by disabling one of the services that conflict,
so sometimes it would be the iscsi serviec, which would make the iso
boot but sometimes it could be other more important services liek teh
local fs or the dracut pre-mount services.

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
(cherry picked from commit 63f0c75d69ab3adca143f917c2e31b75ca3d96c7)

* Bump immucore

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>

---------

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
Co-authored-by: Ettore Di Giacinto <mudler@users.noreply.github.com>
2023-03-01 00:02:10 +01:00
Ettore Di Giacinto
91aa007abb seedling: Create framework images for each flavor (#973)
* 🌱 Create framework images for each flavor

Signed-off-by: mudler <mudler@c3os.io>

* 🌱 Add base cloud config files from packages

Signed-off-by: mudler <mudler@c3os.io>

* 🐧 No need to import base cloud config anymore from repositories

Signed-off-by: mudler <mudler@c3os.io>

* 🤖 Build latest framework images

Signed-off-by: mudler <mudler@c3os.io>

* 🤖 Simplify workflow flavors

Signed-off-by: mudler <mudler@c3os.io>

* 🤖 Make linter happy

Signed-off-by: mudler <mudler@c3os.io>

* 🐛 correctly parse the flavor

Signed-off-by: mudler <mudler@c3os.io>

* 🐛 Fixup copying overlay files in the correct location

Signed-off-by: mudler <mudler@c3os.io>

* 🤖 Set http registry in the self-hosted runner

Signed-off-by: mudler <mudler@c3os.io>

---------

Signed-off-by: mudler <mudler@c3os.io>
2023-02-28 17:58:17 +01:00
Ettore Di Giacinto
74ddd9db88 bug: Add back gdisk to ubuntu/debian images (#959)
* 🐛 Add back gdisk to ubuntu/debian images

Signed-off-by: mudler <mudler@c3os.io>

* 🤖 No need to install mkisofs here

Signed-off-by: mudler <mudler@c3os.io>

---------

Signed-off-by: mudler <mudler@c3os.io>
2023-02-24 13:05:38 +01:00
Shawn Wilsher
019c8b8f8a 🔧 Integrate Shellcheck (#931)
* Add `shellcheck` to lint.

Signed-off-by: Shawn Wilsher <656602+sdwilsh@users.noreply.github.com>

* Fix/Suppress `shellcheck` lint issues

Signed-off-by: Shawn Wilsher <656602+sdwilsh@users.noreply.github.com>

---------

Signed-off-by: Shawn Wilsher <656602+sdwilsh@users.noreply.github.com>
Co-authored-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-02-23 04:36:49 -08:00
Itxaka
7c195374ae bug: copy kairos agent during framework build (#933)
Currently is done during docker image but it makes no sense, it should
be during framework otherwise framework images do not contain the binary

Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-02-21 16:52:09 +01:00
Mauro Morales
22647b7a4e bug: Fix job "Push latest ARM images" caused by docs target (#927)
* print info

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

* Print more

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

* Keep in current dir

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

* list workdir

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

* Evaluate model and userarch

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

* Remove branch used for testing

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

---------

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>
2023-02-20 17:18:59 +01:00
Mauro Morales
be371f84c0 wrench: Lint overlay files (#910)
* YAML lint overlay files

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

* Lint overlay files

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

* Add missing fixes

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

---------

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>
2023-02-17 17:15:27 +01:00
Mauro Morales
3c68f3acca wrench: Build docs on arm64 (#906)
build docs on arm64

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>
2023-02-17 14:17:07 +01:00
Mauro Morales
e2dba6b84e wrench: Automatically create a PR to publish latest schema release on the website (#899)
* Add earthly target to generate cloud config schema

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

* Add schema workflow

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

---------

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>
2023-02-16 11:46:48 +01:00
Mauro Morales
3e9dbe1fb2 wrench: Use yamllint to check lint issues on GH workflows (#892)
* Use yamllint to check lint issues on GH workflows

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

* Split into two different steps

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

* Add yamllint config file

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

* Fix YAmL lint issues in GH workflows

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>

---------

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>
2023-02-15 16:39:10 +01:00
Mauro Morales
9db839cd63 wrench: Add temp-image Earthly target (#876)
Add temp-image Earthly target

This is helpful to quickly generate temp images and upload them to
ttl.sh plus you can quickly distinguish the images by branch and sha

Signed-off-by: Mauro Morales <mauro.morales@spectrocloud.com>
2023-02-13 11:43:19 +01:00
Shawn Wilsher
6bb7d29f2c 🔧 Add docker versioning for the RENOVATE_VERSION (#863)
Add docker versioning for the `RENOVATE_VERSION`

This isn't being picked up in the dashboard (#310), and it might be
because `34` isn't a proper semver.

Signed-off-by: Shawn Wilsher <656602+sdwilsh@users.noreply.github.com>
2023-02-10 00:35:43 -08:00
renovate[bot]
a8fca41b3d Update quay.io/kairos/osbuilder-tools Docker tag to v0.5.2 (#855)
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2023-02-09 13:38:10 +01:00
Shawn Wilsher
b68e5775ce 🔧 Mange the version of quay.io/kairos/osbuilder-tools with renovate (#850)
Mange the version of quay.io/kairos/osbuilder-tools with renovate

This should trigger an update in short order as the current version of
this image is v0.5.2.

Signed-off-by: Shawn Wilsher <656602+sdwilsh@users.noreply.github.com>
2023-02-09 00:37:31 -08:00
Shawn Wilsher
5cc395bfa5 Validate renovate config file during lint (#848)
Now that the config is more than the stock config, and folks are
interested in using it more, we should have some automation to verify
that the config is valid.

Signed-off-by: Shawn Wilsher <656602+sdwilsh@users.noreply.github.com>
2023-02-08 15:55:09 -08:00
Shawn Wilsher
3a74e1228e 🔧 Have renovate manage image versions in Earthfile (#841)
Have renovate manage image versions in `Earthfile`

This change adds support for renovate to be able to update the versions
of `quay.io/luet/base`, `golang`, and `hadolint`.

Signed-off-by: Shawn Wilsher <656602+sdwilsh@users.noreply.github.com>
2023-02-08 00:57:19 -08:00
Oz Tiram
11de7129e0 🔧 merge custom mounts tests (#814)
* 🔧 merge custom mounts tests

Since the feature is now merged, we no longer need
a single label for this. This saves a few CI cycles.
To acheive this, we add the correct sections to the normal
install sections and assert that these paths exist.

The previous assertions are kept, but in order to make
code a bit more readable, I extracted the anonymous function
that collects the data from the installed VM.

Instead of repeating the installation 4 times, we now only
repeat the installation 2 times.

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

* Refactor tests

Works with VBox, fails with QEMU

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

* Fix cloud-config identation

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

---------

Signed-off-by: Oz Tiram <oz@spectrocloud.com>
2023-02-07 17:19:33 +01:00
Shawn Wilsher
ee1e77efbe robot: Add hadolint as part of the automatic lint checks (#818)
* Pull out golint into its own target

Signed-off-by: Shawn Wilsher <656602+sdwilsh@users.noreply.github.com>

* run hadolint on the Docker files in images/

Signed-off-by: Shawn Wilsher <656602+sdwilsh@users.noreply.github.com>

* Ignore existing failures of hadolint, at least for now

Signed-off-by: Shawn Wilsher <656602+sdwilsh@users.noreply.github.com>

---------

Signed-off-by: Shawn Wilsher <656602+sdwilsh@users.noreply.github.com>
2023-02-05 09:10:51 -08:00
Ettore Di Giacinto
203207b93d arrow_up: Bump luet to 0.34.0 (#813)
Signed-off-by: mudler <mudler@c3os.io>
Co-authored-by: Itxaka <itxaka.garcia@spectrocloud.com>
2023-02-03 18:40:41 +01:00
Itxaka
50490c6a31 bug: Remove workaround for polkit dirs (#810)
Looks like there was missing docs for the --keep-own flag on easrthly
and we can indeed keep permissions for all dirs/files when copying
artifacts, but the flag needs to be both on the SAVE ARTIFACT and in the
COPY stanzas.

Signed-off-by: Itxaka <itxaka@spectrocloud.com>
Signed-off-by: Itxaka <itxaka.garcia@spectrocloud.com>
Co-authored-by: Itxaka <itxaka@spectrocloud.com>
2023-02-03 11:34:56 +01:00
Oz Tiram
f8f993f7c5 sparkles: custom user bind and ephemeral mounts (#692)
*  custom user bind and ephemeral mounts

Users can now specify custom and ephemeral mounts in cloud-init under
the `install` section, e.g.:

```
users:
 - name: kairos
...
install:
  auto: true
  device: "auto"
  bind_mounts:
  - /mnt/bind1
  - /mnt/bind2
  ephemeral_mounts:
  - /mnt/ephemeral
  - /mnt/ephemeral2
...
```
Ephemeral mounts are mounted as RW - but changes are discarded when the
machine is restart.
Bind mounts will persist changes after restarted.

This is a fix for #210

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

* Add the custom user mount to /cos/run/cos-layout.env

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

* Add docs for custom user mounts in configuration example

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

* Reuse test_install function

DRY the code, change how we call the function install_test

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

* Enable custom mount tests and install tests

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

* Enable tests in CI

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

* Remove duplicate if check

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

* Remove uneeded fmt.Println ...

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

* Use separate label for custom mounts

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

* 🔧 Earthfile - DRY ginkgo

We repeat this a more than twice so just extract to own
target...

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

* Correct return type for  ContainElements

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

* Remove CLOUD_INIT from custom mounts test

This is not needed here.

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

* Fix qemu-test-* earthly targets

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

* 🔧 Fix CPU passing to VM

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

* 🔧 remove apt cache after install qemu

Helps deal with space running out in the CI.

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

* 📖 Document custom mounts

Signed-off-by: Oz Tiram <oz@spectrocloud.com>

---------

Signed-off-by: Oz Tiram <oz@spectrocloud.com>
Co-authored-by: Ettore Di Giacinto <mudler@users.noreply.github.com>
2023-02-03 11:04:02 +01:00
Itxaka
a37f68cf00 penguin: Disable squasfs compression for ISO building (#812)
Space gained is negligible, just a few Kbs usually (with gzip as its
currently) but the speed up improvements in building the ISO are really
good, for 20 seconds to 40 seconds per ISO build, and that gets more accentuated
on CI runs where the runners are more CPU constrained.

Signed-off-by: Itxaka <itxaka@spectrocloud.com>
Co-authored-by: Itxaka <itxaka@spectrocloud.com>
2023-02-03 11:03:20 +01:00
Itxaka
051413547b bug: Fix wrong IF line in Earthfile (#785)
Looks like a ] was missing and instead of crashing and burning, earthly
continued happily, which meant that on v1.5.0 ARM tumbleweed images the
initrd is missing as earthly failed to parse the check but did not
errored out.

Signed-off-by: Itxaka <itxaka@spectrocloud.com>
Co-authored-by: Itxaka <itxaka@spectrocloud.com>
2023-01-30 22:11:48 +01:00