mirror of
https://github.com/wahyd4/cert-manager.git
synced 2026-08-08 20:58:17 +10:00
Add a makefile flow for building artifacts
Includes targets for: - all "server" binaries, for all arches - all containers for all server binaries for all arches - all client binaries (kubectl plugin / cmctl) for all arches - the cert-manager helm chart + signature - the cert-manager static manifests + CRDs - tools which bazel would download, with checksum verification - (commented out) a signed SHA256SUM file for client binaries Upgrades from the bazel flow include that: - we use OS-specific base images rather than just using amd64 everywhere - we easily add support for signing artifacts at build time - we add ".exe" to the end of windows executables - we add a zip file for windows executables, for easier consumption - we concatenate YAML files more robustly - staging a full release should be much faster - hopefully, it's easier to change things! - licenses are trimmed down to reduce bloat in images (the license bundle was 1.4MB in size alone) Changes from the bazel flow include: - containers no longer have a symlink to the binary at an unusual path, but instead just have the binary at a more predictable path (e.g. /app/cmd/webhook/webhook instead of /app/cmd/webhook/webhook.runfiles/com_github_jetstack_cert_manager/cmd/webhook/webhook_/webhook) Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
This commit is contained in:
Ashley Davis
@@ -0,0 +1,7 @@
|
||||
bin/*
|
||||
bazel*
|
||||
|
||||
!bin/server/**
|
||||
!bin/cmctl/cmctl-linux-*
|
||||
!bin/scratch/cert-manager.license
|
||||
!bin/scratch/cert-manager.licenses_notice
|
||||
@@ -13,3 +13,4 @@ bazel-*
|
||||
/.project
|
||||
_artifacts/
|
||||
/vendor/
|
||||
bin/
|
||||
|
||||
@@ -0,0 +1,2 @@
|
||||
fingerprint: 1020CF3C033D4F35BAE1C19E1226061C665DF13E
|
||||
url: https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: cert-manager
|
||||
@@ -0,0 +1,6 @@
|
||||
{
|
||||
"name": "TODO",
|
||||
"sha256": "TODO",
|
||||
"os": "TODO",
|
||||
"architecture": "TODO"
|
||||
}
|
||||
Executable
+43
@@ -0,0 +1,43 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright 2021 The cert-manager Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -eu -o pipefail
|
||||
|
||||
while (($#)); do
|
||||
f=$1
|
||||
if [[ ! -f "$f" ]]; then
|
||||
echo "$f doesn't exist, exiting" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# The YAML spec requires that a YAML directive only appears once in a document
|
||||
# We probably won't have any directives, so we just check for any directive and
|
||||
# fail if there's one in any of the files
|
||||
# https://yaml.org/spec/1.2.2/#681-yaml-directives
|
||||
if grep -q "%YAML" $f; then
|
||||
echo "found %YAML directive in file; this can't be handled safely by this script" 1>&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cat $f
|
||||
|
||||
shift
|
||||
|
||||
# if there's at least one more file left, output the YAML file separator
|
||||
if [[ $# -gt 0 ]]; then
|
||||
echo "---"
|
||||
fi
|
||||
done
|
||||
@@ -0,0 +1,16 @@
|
||||
ARG BASE_IMAGE
|
||||
|
||||
FROM $BASE_IMAGE
|
||||
|
||||
ARG BINARY_PATH
|
||||
ARG LICENSE_PATH
|
||||
ARG LICENSES_PATH
|
||||
|
||||
COPY $BINARY_PATH /app/cmd/acmesolver/acmesolver
|
||||
|
||||
COPY $LICENSE_PATH /licenses/LICENSE
|
||||
COPY $LICENSES_PATH /licenses/LICENSES
|
||||
|
||||
ENTRYPOINT ["/app/cmd/acmesolver/acmesolver"]
|
||||
|
||||
# vim: syntax=dockerfile
|
||||
@@ -0,0 +1,16 @@
|
||||
ARG BASE_IMAGE
|
||||
|
||||
FROM $BASE_IMAGE
|
||||
|
||||
ARG BINARY_PATH
|
||||
ARG LICENSE_PATH
|
||||
ARG LICENSES_PATH
|
||||
|
||||
COPY $BINARY_PATH /app/cmd/cainjector/cainjector
|
||||
|
||||
COPY $LICENSE_PATH /licenses/LICENSE
|
||||
COPY $LICENSES_PATH /licenses/LICENSES
|
||||
|
||||
ENTRYPOINT ["/app/cmd/cainjector/cainjector"]
|
||||
|
||||
# vim: syntax=dockerfile
|
||||
@@ -0,0 +1,16 @@
|
||||
ARG BASE_IMAGE
|
||||
|
||||
FROM $BASE_IMAGE
|
||||
|
||||
ARG BINARY_PATH
|
||||
ARG LICENSE_PATH
|
||||
ARG LICENSES_PATH
|
||||
|
||||
COPY $BINARY_PATH /app/cmd/controller/controller
|
||||
|
||||
COPY $LICENSE_PATH /licenses/LICENSE
|
||||
COPY $LICENSES_PATH /licenses/LICENSES
|
||||
|
||||
ENTRYPOINT ["/app/cmd/controller/controller"]
|
||||
|
||||
# vim: syntax=dockerfile
|
||||
@@ -0,0 +1,16 @@
|
||||
ARG BASE_IMAGE
|
||||
|
||||
FROM $BASE_IMAGE
|
||||
|
||||
ARG BINARY_PATH
|
||||
ARG LICENSE_PATH
|
||||
ARG LICENSES_PATH
|
||||
|
||||
COPY $BINARY_PATH /app/cmd/ctl/ctl
|
||||
|
||||
COPY $LICENSE_PATH /licenses/LICENSE
|
||||
COPY $LICENSES_PATH /licenses/LICENSES
|
||||
|
||||
ENTRYPOINT ["/app/cmd/ctl/ctl"]
|
||||
|
||||
# vim: syntax=dockerfile
|
||||
@@ -0,0 +1,16 @@
|
||||
ARG BASE_IMAGE
|
||||
|
||||
FROM $BASE_IMAGE
|
||||
|
||||
ARG BINARY_PATH
|
||||
ARG LICENSE_PATH
|
||||
ARG LICENSES_PATH
|
||||
|
||||
COPY $BINARY_PATH /app/cmd/webhook/webhook
|
||||
|
||||
COPY $LICENSE_PATH /licenses/LICENSE
|
||||
COPY $LICENSES_PATH /licenses/LICENSES
|
||||
|
||||
ENTRYPOINT ["/app/cmd/webhook/webhook"]
|
||||
|
||||
# vim: syntax=dockerfile
|
||||
@@ -1,7 +1,27 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copyright 2021 The cert-manager Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
set -eu -o pipefail
|
||||
|
||||
# This script fetches the latest sha256 digest of each base image for each architecture we support on servers
|
||||
# and writes those hashes to Makefile-formatted variables for use in Makefiles.
|
||||
|
||||
# This in turn allows us to easily update all base images to their latest versions, while mantaining the use
|
||||
# of digests rather than tags when we refer to these base images.
|
||||
|
||||
TARGET=make/base_images.mk
|
||||
|
||||
STATIC_BASE=gcr.io/distroless/static
|
||||
@@ -9,7 +29,7 @@ DYNAMIC_BASE=gcr.io/distroless/base
|
||||
|
||||
mkdir -p make
|
||||
|
||||
echo "# autogenerated by hack/latest_base_images.sh" > $TARGET
|
||||
echo "# autogenerated by hack/latest-base-images.sh" > $TARGET
|
||||
|
||||
echo "STATIC_BASE_IMAGE_amd64 := $STATIC_BASE@$(crane digest $STATIC_BASE:latest-amd64)" >> $TARGET
|
||||
echo "STATIC_BASE_IMAGE_arm64 := $STATIC_BASE@$(crane digest $STATIC_BASE:latest-arm64)" >> $TARGET
|
||||
+107
@@ -0,0 +1,107 @@
|
||||
# Copyright 2021 The cert-manager Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
SHELL := /usr/bin/env bash
|
||||
.SHELLFLAGS := -uo pipefail -c
|
||||
|
||||
SOURCES := $(shell find . -type f -name "*.go")
|
||||
|
||||
GOFLAGS := -ldflags '-w -s' -trimpath
|
||||
|
||||
# GOBUILDPROCS is passed to GOMAXPROCS when running go build; if you're running make in parallel
|
||||
# using "-jN" then you'll probably want to reduce the value of GOBUILDPROCS or else you could end
|
||||
# up running N parallel invocations of go build, each of which will spin up as many threads as are
|
||||
# available on your system.
|
||||
GOBUILDPROCS ?=
|
||||
|
||||
# Set this as an environment variable to enable signing commands using cmrel
|
||||
# Format should be:
|
||||
# projects/<project>/locations/<location>/keyRings/<keyring>/cryptoKeys/<keyname>/cryptoKeyVersions/<keyversion>
|
||||
CMREL_KEY ?= ""
|
||||
|
||||
HOST_OS = $(shell $(GO) env GOOS)
|
||||
HOST_ARCH = $(shell $(GO) env GOARCH)
|
||||
|
||||
include make/git.mk
|
||||
include make/tools.mk
|
||||
include make/base_images.mk
|
||||
include make/cmctl.mk
|
||||
include make/server.mk
|
||||
include make/containers.mk
|
||||
include make/release_containers.mk
|
||||
include make/manifests.mk
|
||||
include make/licenses.mk
|
||||
|
||||
.PHONY: all
|
||||
all: binaries helm-chart static-manifests all-containers ## Build all artifacts which might be run or used locally, except for anything signed.
|
||||
|
||||
.PHONY: all-signed
|
||||
all-signed: all ## Build `all` followed by signed artifacts which require a key to be configured.
|
||||
$(MAKE) -f make/Makefile signed-artifacts
|
||||
|
||||
.PHONY: binaries
|
||||
binaries: server-binaries cmctl kubectl-cert_manager ## Build all binaries for all server and client platforms
|
||||
|
||||
.PHONY: signed-artifacts
|
||||
signed-artifacts: helm-chart-signature ## Shorthand to create all artifacts which can be signed (and which therefore require signing keys to be configured)
|
||||
|
||||
.PHONY: staged-release
|
||||
staged-release: all-signed release-manifests release-containers ## Creates a full release ready to be staged, including containers bundled for distribution. Requires signing keys to be configured.
|
||||
$(MAKE) -f make/Makefile bin/release/metadata.json
|
||||
|
||||
# Takes all metadata files in bin/metadata and combines them into one
|
||||
bin/release/metadata.json: $(wildcard bin/metadata/*.json) | bin/release
|
||||
jq -n \
|
||||
--arg releaseVersion "$(RELEASE_VERSION)" \
|
||||
--arg gitCommitRef "$(GITCOMMIT)" \
|
||||
'.releaseVersion = $$releaseVersion | .gitCommitRef = $$gitCommitRef | .artifacts += [inputs]' $^ > $@
|
||||
|
||||
.PHONY: clean
|
||||
clean: ## Remove the bin directory, cleaning all built artifacts and locally installed tools
|
||||
rm -rf bin
|
||||
|
||||
bin:
|
||||
@mkdir -p $@
|
||||
|
||||
bin/scratch:
|
||||
@mkdir -p $@
|
||||
|
||||
bin/release:
|
||||
@mkdir -p $@
|
||||
|
||||
bin/metadata:
|
||||
@mkdir -p $@
|
||||
|
||||
# Set this as an environment variable to enable signing commands using cosign
|
||||
# Format should be any accepted by cosign; for GCP, use:
|
||||
# gcpkms://projects/<project>/locations/<location>/keyRings/<keyring>/cryptoKeys/<keyname>/versions/<keyversion>
|
||||
# CMREL_KEY ?= ""
|
||||
# Example of how we can generate a SHA256SUMS file and sign it using cosign
|
||||
#bin/SHA256SUMS: $(wildcard ...)
|
||||
# @# The patsubst means "all dependencies, but with "bin/" trimmed off the beginning
|
||||
# @# We cd into bin so that SHA256SUMS file doesn't have a prefix of `bin` on everything
|
||||
# cd $(dir $@) && sha256sum $(patsubst bin/%,%,$^) > $(notdir $@)
|
||||
#
|
||||
#bin/SHA256SUMS.sig: bin/SHA256SUMS | bin/tools/cosign
|
||||
# $(COSIGN) sign-blob --key $(COSIGN_KEY) $< > $@
|
||||
|
||||
# This target allows us to set all the modified times for all files in bin to the same time, which
|
||||
# is similar to what bazel does. We might not want this, and it's not currently used.
|
||||
.PHONY: forcetime
|
||||
forcetime: | bin
|
||||
find bin | xargs touch -d "2000-01-01 00:00:00" -
|
||||
|
||||
.PHONY: help
|
||||
help: ## Display this help.
|
||||
@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
|
||||
@@ -0,0 +1,11 @@
|
||||
# autogenerated by hack/latest-base-images.sh
|
||||
STATIC_BASE_IMAGE_amd64 := gcr.io/distroless/static@sha256:a5635fa9dda1cf81666d8c288130bf3519bdeab1b7ed717db496a73d25d1b35c
|
||||
STATIC_BASE_IMAGE_arm64 := gcr.io/distroless/static@sha256:cc7389ac8f818fa1af21bd9ff456987cc2d42577013ab2d02807c51378f5c036
|
||||
STATIC_BASE_IMAGE_s390x := gcr.io/distroless/static@sha256:3e60feae6e1cd2b6fe0d8e0c4d9811231e73b0ce4cf5059373d56d1de469ecc9
|
||||
STATIC_BASE_IMAGE_ppc64le := gcr.io/distroless/static@sha256:e0d91a3255efe07a17ca828eab3a9068e4757a1e86bc8d83c9a031ebda7a19ad
|
||||
STATIC_BASE_IMAGE_arm := gcr.io/distroless/static@sha256:a81c4c77b601a31c2b4a77ff9fd2aa7f80b1d542ea2d6cc0d9b056a6e6f17a0d
|
||||
DYNAMIC_BASE_IMAGE_amd64 := gcr.io/distroless/base@sha256:1a80a34cb3d7c4326191047976e4161741aef22c351932b55e32b72ce8827c27
|
||||
DYNAMIC_BASE_IMAGE_arm64 := gcr.io/distroless/base@sha256:f557575011fd640f984c56d74ca8f0708a50b3252a15db6e1a4895594c531bbf
|
||||
DYNAMIC_BASE_IMAGE_s390x := gcr.io/distroless/base@sha256:46c4936e7e3f20c9ae802d4ebf361966bd3a177e1342d566c52d4daad3e355b5
|
||||
DYNAMIC_BASE_IMAGE_ppc64le := gcr.io/distroless/base@sha256:a04ec0087837bc289056a5477fe2dc86745951dfe8419afe419426325cbb4c8f
|
||||
DYNAMIC_BASE_IMAGE_arm := gcr.io/distroless/base@sha256:4e72c245399db1a2f89d70ce2839c024ded5051d13e78d9d09b9a7c48155d1fd
|
||||
+221
@@ -0,0 +1,221 @@
|
||||
CMCTL_GOFLAGS=$(GOFLAGS) -ldflags '-X "github.com/jetstack/cert-manager/cmd/ctl/pkg/build.name=cmctl" -X "github.com/jetstack/cert-manager/cmd/ctl/pkg/build/commands.registerCompletion=true"'
|
||||
|
||||
KUBECTL_PLUGIN_GOFLAGS=$(GOFLAGS) -ldflags '-X "github.com/jetstack/cert-manager/cmd/ctl/pkg/build.name=kubectl cert-manager" -X "github.com/jetstack/cert-manager/cmd/ctl/pkg/build/commands.registerCompletion=false"'
|
||||
|
||||
bin/cmctl:
|
||||
@mkdir -p $@
|
||||
|
||||
bin/kubectl-cert_manager:
|
||||
@mkdir -p $@
|
||||
|
||||
.PHONY: cmctl
|
||||
cmctl: cmctl-linux cmctl-linux-tarballs cmctl-linux-metadata cmctl-darwin cmctl-darwin-tarballs cmctl-darwin-metadata cmctl-windows cmctl-windows-tarballs cmctl-windows-metadata | bin/cmctl
|
||||
|
||||
.PHONY: cmctl-linux
|
||||
cmctl-linux: bin/cmctl/cmctl-linux-amd64 bin/cmctl/cmctl-linux-arm64 bin/cmctl/cmctl-linux-s390x bin/cmctl/cmctl-linux-ppc64le bin/cmctl/cmctl-linux-arm | bin/cmctl
|
||||
|
||||
.PHONY: cmctl-linux-tarballs
|
||||
cmctl-linux-tarballs: bin/release/cert-manager-cmctl-linux-amd64.tar.gz bin/release/cert-manager-cmctl-linux-arm64.tar.gz bin/release/cert-manager-cmctl-linux-s390x.tar.gz bin/release/cert-manager-cmctl-linux-ppc64le.tar.gz bin/release/cert-manager-cmctl-linux-arm.tar.gz | bin/release
|
||||
|
||||
.PHONY: cmctl-linux-metadata
|
||||
cmctl-linux-metadata: bin/metadata/cert-manager-cmctl-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-arm.tar.gz.metadata.json | bin/metadata
|
||||
|
||||
bin/cmctl/cmctl-linux-amd64 bin/cmctl/cmctl-linux-arm64 bin/cmctl/cmctl-linux-s390x bin/cmctl/cmctl-linux-ppc64le: bin/cmctl/cmctl-linux-%: $(SOURCES) | bin/cmctl
|
||||
GOOS=linux GOARCH=$* $(GOBUILD) -o $@ $(CMCTL_GOFLAGS) cmd/ctl/main.go
|
||||
|
||||
bin/cmctl/cmctl-linux-arm: $(SOURCES) | bin/cmctl
|
||||
GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(CMCTL_GOFLAGS) cmd/ctl/main.go
|
||||
|
||||
bin/release/cert-manager-cmctl-linux-amd64.tar.gz bin/release/cert-manager-cmctl-linux-arm64.tar.gz bin/release/cert-manager-cmctl-linux-s390x.tar.gz bin/release/cert-manager-cmctl-linux-ppc64le.tar.gz bin/release/cert-manager-cmctl-linux-arm.tar.gz: bin/release/cert-manager-cmctl-linux-%.tar.gz: bin/cmctl/cmctl-linux-% bin/scratch/cert-manager.license | bin/scratch bin/release
|
||||
$(eval TARDIR := bin/scratch/$(notdir $@))
|
||||
mkdir -p $(TARDIR)
|
||||
cp $< $(TARDIR)/cmctl
|
||||
cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
|
||||
tar czf $@ -C $(TARDIR) .
|
||||
rm -rf $(TARDIR)
|
||||
|
||||
bin/metadata/cert-manager-cmctl-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-linux-arm.tar.gz.metadata.json: bin/metadata/cert-manager-cmctl-linux-%.tar.gz.metadata.json: bin/release/cert-manager-cmctl-linux-%.tar.gz hack/artifact-metadata.template.json | bin/metadata
|
||||
jq --arg name "$(notdir $<)" \
|
||||
--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
|
||||
--arg os "linux" \
|
||||
--arg architecture "$*" \
|
||||
'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
|
||||
hack/artifact-metadata.template.json > $@
|
||||
|
||||
.PHONY: cmctl-darwin
|
||||
cmctl-darwin: bin/cmctl/cmctl-darwin-amd64 bin/cmctl/cmctl-darwin-arm64 | bin/cmctl
|
||||
|
||||
.PHONY: cmctl-darwin-tarballs
|
||||
cmctl-darwin-tarballs: bin/release/cert-manager-cmctl-darwin-amd64.tar.gz bin/release/cert-manager-cmctl-darwin-arm64.tar.gz | bin/release
|
||||
|
||||
.PHONY: cmctl-darwin-metadata
|
||||
cmctl-darwin-metadata: bin/metadata/cert-manager-cmctl-darwin-amd64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-darwin-arm64.tar.gz.metadata.json | bin/metadata
|
||||
|
||||
bin/cmctl/cmctl-darwin-amd64 bin/cmctl/cmctl-darwin-arm64: bin/cmctl/cmctl-darwin-%: $(SOURCES) | bin/cmctl
|
||||
GOOS=darwin GOARCH=$* $(GOBUILD) -o $@ $(CMCTL_GOFLAGS) cmd/ctl/main.go
|
||||
|
||||
bin/release/cert-manager-cmctl-darwin-amd64.tar.gz bin/release/cert-manager-cmctl-darwin-arm64.tar.gz: bin/release/cert-manager-cmctl-darwin-%.tar.gz: bin/cmctl/cmctl-darwin-% bin/scratch/cert-manager.license | bin/scratch bin/release
|
||||
$(eval TARDIR := bin/scratch/$(notdir $@))
|
||||
mkdir -p $(TARDIR)
|
||||
cp $< $(TARDIR)/cmctl
|
||||
cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
|
||||
tar czf $@ -C $(TARDIR) .
|
||||
rm -rf $(TARDIR)
|
||||
|
||||
bin/metadata/cert-manager-cmctl-darwin-amd64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-darwin-arm64.tar.gz.metadata.json: bin/metadata/cert-manager-cmctl-darwin-%.tar.gz.metadata.json: bin/release/cert-manager-cmctl-darwin-%.tar.gz hack/artifact-metadata.template.json | bin/metadata
|
||||
jq --arg name "$(notdir $<)" \
|
||||
--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
|
||||
--arg os "darwin" \
|
||||
--arg architecture "$*" \
|
||||
'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
|
||||
hack/artifact-metadata.template.json > $@
|
||||
|
||||
.PHONY: cmctl-windows
|
||||
cmctl-windows: bin/cmctl/cmctl-windows-amd64.exe | bin/cmctl
|
||||
|
||||
.PHONY: cmctl-windows-tarballs
|
||||
cmctl-windows-tarballs: bin/release/cert-manager-cmctl-windows-amd64.tar.gz bin/release/cert-manager-cmctl-windows-amd64.zip | bin/release
|
||||
|
||||
.PHONY: cmctl-windows-metadata
|
||||
cmctl-windows-metadata: bin/metadata/cert-manager-cmctl-windows-amd64.tar.gz.metadata.json bin/metadata/cert-manager-cmctl-windows-amd64.zip.metadata.json | bin/release
|
||||
|
||||
bin/cmctl/cmctl-windows-amd64.exe: $(SOURCES) | bin/cmctl
|
||||
GOOS=windows GOARCH=amd64 $(GOBUILD) -o $@ $(CMCTL_GOFLAGS) cmd/ctl/main.go
|
||||
|
||||
bin/release/cert-manager-cmctl-windows-amd64.zip: bin/cmctl/cmctl-windows-amd64.exe bin/scratch/cert-manager.license | bin/scratch bin/release
|
||||
$(eval TARDIR := bin/scratch/$(notdir $@))
|
||||
mkdir -p $(TARDIR)
|
||||
cp $< $(TARDIR)/cmctl.exe
|
||||
cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
|
||||
pushd $(TARDIR) && zip -r $(notdir $@) . && popd && mv $(TARDIR)/$(notdir $@) $@
|
||||
rm -rf $(TARDIR)
|
||||
|
||||
bin/release/cert-manager-cmctl-windows-amd64.tar.gz: bin/cmctl/cmctl-windows-amd64.exe bin/scratch/cert-manager.license | bin/scratch bin/release
|
||||
$(eval TARDIR := bin/scratch/$(notdir $@))
|
||||
mkdir -p $(TARDIR)
|
||||
cp $< $(TARDIR)/cmctl.exe
|
||||
cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
|
||||
tar czf $@ -C $(TARDIR) .
|
||||
rm -rf $(TARDIR)
|
||||
|
||||
bin/metadata/cert-manager-cmctl-windows-amd64.tar.gz.metadata.json: bin/release/cert-manager-cmctl-windows-amd64.tar.gz hack/artifact-metadata.template.json | bin/metadata
|
||||
jq --arg name "$(notdir $<)" \
|
||||
--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
|
||||
--arg os "windows" \
|
||||
--arg architecture "amd64" \
|
||||
'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
|
||||
hack/artifact-metadata.template.json > $@
|
||||
|
||||
bin/metadata/cert-manager-cmctl-windows-amd64.zip.metadata.json: bin/release/cert-manager-cmctl-windows-amd64.zip hack/artifact-metadata.template.json | bin/metadata
|
||||
jq --arg name "$(notdir $<)" \
|
||||
--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
|
||||
--arg os "windows" \
|
||||
--arg architecture "amd64" \
|
||||
'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
|
||||
hack/artifact-metadata.template.json > $@
|
||||
|
||||
.PHONY: kubectl-cert_manager
|
||||
kubectl-cert_manager: kubectl-cert_manager-linux kubectl-cert_manager-linux-tarballs kubectl-cert_manager-linux-metadata kubectl-cert_manager-darwin kubectl-cert_manager-darwin-tarballs kubectl-cert_manager-darwin-metadata kubectl-cert_manager-windows kubectl-cert_manager-windows-tarballs kubectl-cert_manager-windows-metadata | bin/kubectl-cert_manager
|
||||
|
||||
.PHONY: kubectl-cert_manager-linux
|
||||
kubectl-cert_manager-linux: bin/kubectl-cert_manager/kubectl-cert_manager-linux-amd64 bin/kubectl-cert_manager/kubectl-cert_manager-linux-arm64 bin/kubectl-cert_manager/kubectl-cert_manager-linux-s390x bin/kubectl-cert_manager/kubectl-cert_manager-linux-ppc64le bin/kubectl-cert_manager/kubectl-cert_manager-linux-arm | bin/kubectl-cert_manager
|
||||
|
||||
.PHONY: kubectl-cert_manager-linux-tarballs
|
||||
kubectl-cert_manager-linux-tarballs: bin/release/cert-manager-kubectl-cert_manager-linux-amd64.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-arm64.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-s390x.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-ppc64le.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-arm.tar.gz | bin/release
|
||||
|
||||
.PHONY: kubectl-cert_manager-linux-metadata
|
||||
kubectl-cert_manager-linux-metadata: bin/metadata/cert-manager-kubectl-cert_manager-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-arm.tar.gz.metadata.json | bin/metadata
|
||||
|
||||
bin/kubectl-cert_manager/kubectl-cert_manager-linux-amd64 bin/kubectl-cert_manager/kubectl-cert_manager-linux-arm64 bin/kubectl-cert_manager/kubectl-cert_manager-linux-s390x bin/kubectl-cert_manager/kubectl-cert_manager-linux-ppc64le: bin/kubectl-cert_manager/kubectl-cert_manager-linux-%: $(SOURCES) | bin/kubectl-cert_manager
|
||||
GOOS=linux GOARCH=$* $(GOBUILD) -o $@ $(KUBECTL_PLUGIN_GOFLAGS) cmd/ctl/main.go
|
||||
|
||||
bin/kubectl-cert_manager/kubectl-cert_manager-linux-arm: $(SOURCES) | bin/kubectl-cert_manager
|
||||
GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(KUBECTL_PLUGIN_GOFLAGS) cmd/ctl/main.go
|
||||
|
||||
bin/release/cert-manager-kubectl-cert_manager-linux-amd64.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-arm64.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-s390x.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-ppc64le.tar.gz bin/release/cert-manager-kubectl-cert_manager-linux-arm.tar.gz: bin/release/cert-manager-kubectl-cert_manager-linux-%.tar.gz: bin/kubectl-cert_manager/kubectl-cert_manager-linux-% bin/scratch/cert-manager.license | bin/scratch bin/release
|
||||
$(eval TARDIR := bin/scratch/$(notdir $@))
|
||||
mkdir -p $(TARDIR)
|
||||
cp $< $(TARDIR)/kubectl-cert_manager
|
||||
cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
|
||||
tar czf $@ -C $(TARDIR) .
|
||||
rm -rf $(TARDIR)
|
||||
|
||||
bin/metadata/cert-manager-kubectl-cert_manager-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-linux-arm.tar.gz.metadata.json: bin/metadata/cert-manager-kubectl-cert_manager-linux-%.tar.gz.metadata.json: bin/release/cert-manager-kubectl-cert_manager-linux-%.tar.gz hack/artifact-metadata.template.json | bin/metadata
|
||||
jq --arg name "$(notdir $<)" \
|
||||
--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
|
||||
--arg os "linux" \
|
||||
--arg architecture "$*" \
|
||||
'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
|
||||
hack/artifact-metadata.template.json > $@
|
||||
|
||||
.PHONY: kubectl-cert_manager-darwin
|
||||
kubectl-cert_manager-darwin: bin/kubectl-cert_manager/kubectl-cert_manager-darwin-amd64 bin/kubectl-cert_manager/kubectl-cert_manager-darwin-arm64 | bin/kubectl-cert_manager
|
||||
|
||||
.PHONY: kubectl-cert_manager-darwin-tarballs
|
||||
kubectl-cert_manager-darwin-tarballs: bin/release/cert-manager-kubectl-cert_manager-darwin-amd64.tar.gz bin/release/cert-manager-kubectl-cert_manager-darwin-arm64.tar.gz | bin/release
|
||||
|
||||
.PHONY: kubectl-cert_manager-darwin-metadata
|
||||
kubectl-cert_manager-darwin-metadata: bin/metadata/cert-manager-kubectl-cert_manager-darwin-amd64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-darwin-arm64.tar.gz.metadata.json | bin/metadata
|
||||
|
||||
bin/kubectl-cert_manager/kubectl-cert_manager-darwin-amd64 bin/kubectl-cert_manager/kubectl-cert_manager-darwin-arm64: bin/kubectl-cert_manager/kubectl-cert_manager-darwin-%: $(SOURCES) | bin/kubectl-cert_manager
|
||||
GOOS=darwin GOARCH=$* $(GOBUILD) -o $@ $(KUBECTL_PLUGIN_GOFLAGS) cmd/ctl/main.go
|
||||
|
||||
bin/release/cert-manager-kubectl-cert_manager-darwin-amd64.tar.gz bin/release/cert-manager-kubectl-cert_manager-darwin-arm64.tar.gz: bin/release/cert-manager-kubectl-cert_manager-darwin-%.tar.gz: bin/kubectl-cert_manager/kubectl-cert_manager-darwin-% bin/scratch/cert-manager.license | bin/scratch bin/release
|
||||
$(eval TARDIR := bin/scratch/$(notdir $@))
|
||||
mkdir -p $(TARDIR)
|
||||
cp $< $(TARDIR)/kubectl-cert_manager
|
||||
cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
|
||||
tar czf $@ -C $(TARDIR) .
|
||||
rm -rf $(TARDIR)
|
||||
|
||||
bin/metadata/cert-manager-kubectl-cert_manager-darwin-amd64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-darwin-arm64.tar.gz.metadata.json: bin/metadata/cert-manager-kubectl-cert_manager-darwin-%.tar.gz.metadata.json: bin/release/cert-manager-kubectl-cert_manager-darwin-%.tar.gz hack/artifact-metadata.template.json | bin/metadata
|
||||
jq --arg name "$(notdir $<)" \
|
||||
--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
|
||||
--arg os "darwin" \
|
||||
--arg architecture "$*" \
|
||||
'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
|
||||
hack/artifact-metadata.template.json > $@
|
||||
|
||||
.PHONY: kubectl-cert_manager-windows
|
||||
kubectl-cert_manager-windows: bin/kubectl-cert_manager/kubectl-cert_manager-windows-amd64.exe | bin/kubectl-cert_manager
|
||||
|
||||
.PHONY: kubectl-cert_manager-windows-tarballs
|
||||
kubectl-cert_manager-windows-tarballs: bin/release/cert-manager-kubectl-cert_manager-windows-amd64.tar.gz bin/release/cert-manager-kubectl-cert_manager-windows-amd64.zip | bin/release
|
||||
|
||||
.PHONY: kubectl-cert_manager-windows-metadata
|
||||
kubectl-cert_manager-windows-metadata: bin/metadata/cert-manager-kubectl-cert_manager-windows-amd64.tar.gz.metadata.json bin/metadata/cert-manager-kubectl-cert_manager-windows-amd64.zip.metadata.json | bin/release
|
||||
|
||||
bin/kubectl-cert_manager/kubectl-cert_manager-windows-amd64.exe: $(SOURCES) | bin/kubectl-cert_manager
|
||||
GOOS=windows GOARCH=amd64 $(GOBUILD) -o $@ $(KUBECTL_PLUGIN_GOFLAGS) cmd/ctl/main.go
|
||||
|
||||
bin/release/cert-manager-kubectl-cert_manager-windows-amd64.zip: bin/kubectl-cert_manager/kubectl-cert_manager-windows-amd64.exe bin/scratch/cert-manager.license | bin/scratch bin/release
|
||||
$(eval TARDIR := bin/scratch/$(notdir $@))
|
||||
mkdir -p $(TARDIR)
|
||||
cp $< $(TARDIR)/kubectl-cert_manager.exe
|
||||
cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
|
||||
pushd $(TARDIR) && zip -r $(notdir $@) . && popd && mv $(TARDIR)/$(notdir $@) $@
|
||||
rm -rf $(TARDIR)
|
||||
|
||||
bin/release/cert-manager-kubectl-cert_manager-windows-amd64.tar.gz: bin/kubectl-cert_manager/kubectl-cert_manager-windows-amd64.exe bin/scratch/cert-manager.license | bin/scratch bin/release
|
||||
$(eval TARDIR := bin/scratch/$(notdir $@))
|
||||
mkdir -p $(TARDIR)
|
||||
cp $< $(TARDIR)/kubectl-cert_manager.exe
|
||||
cp bin/scratch/cert-manager.license $(TARDIR)/LICENSE
|
||||
tar czf $@ -C $(TARDIR) .
|
||||
rm -rf $(TARDIR)
|
||||
|
||||
bin/metadata/cert-manager-kubectl-cert_manager-windows-amd64.tar.gz.metadata.json: bin/release/cert-manager-kubectl-cert_manager-windows-amd64.tar.gz hack/artifact-metadata.template.json | bin/metadata
|
||||
jq --arg name "$(notdir $<)" \
|
||||
--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
|
||||
--arg os "windows" \
|
||||
--arg architecture "amd64" \
|
||||
'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
|
||||
hack/artifact-metadata.template.json > $@
|
||||
|
||||
bin/metadata/cert-manager-kubectl-cert_manager-windows-amd64.zip.metadata.json: bin/release/cert-manager-kubectl-cert_manager-windows-amd64.zip hack/artifact-metadata.template.json | bin/metadata
|
||||
jq --arg name "$(notdir $<)" \
|
||||
--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
|
||||
--arg os "windows" \
|
||||
--arg architecture "amd64" \
|
||||
'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
|
||||
hack/artifact-metadata.template.json > $@
|
||||
@@ -0,0 +1,118 @@
|
||||
# set to "DYNAMIC" to use a dynamic base image
|
||||
BASE_IMAGE_TYPE:=STATIC
|
||||
|
||||
BASE_IMAGE_controller-linux-amd64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_amd64)
|
||||
BASE_IMAGE_controller-linux-arm64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm64)
|
||||
BASE_IMAGE_controller-linux-s390x:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_s390x)
|
||||
BASE_IMAGE_controller-linux-ppc64le:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_ppc64le)
|
||||
BASE_IMAGE_controller-linux-arm:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm)
|
||||
|
||||
BASE_IMAGE_webhook-linux-amd64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_amd64)
|
||||
BASE_IMAGE_webhook-linux-arm64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm64)
|
||||
BASE_IMAGE_webhook-linux-s390x:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_s390x)
|
||||
BASE_IMAGE_webhook-linux-ppc64le:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_ppc64le)
|
||||
BASE_IMAGE_webhook-linux-arm:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm)
|
||||
|
||||
BASE_IMAGE_acmesolver-linux-amd64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_amd64)
|
||||
BASE_IMAGE_acmesolver-linux-arm64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm64)
|
||||
BASE_IMAGE_acmesolver-linux-s390x:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_s390x)
|
||||
BASE_IMAGE_acmesolver-linux-ppc64le:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_ppc64le)
|
||||
BASE_IMAGE_acmesolver-linux-arm:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm)
|
||||
|
||||
BASE_IMAGE_cainjector-linux-amd64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_amd64)
|
||||
BASE_IMAGE_cainjector-linux-arm64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm64)
|
||||
BASE_IMAGE_cainjector-linux-s390x:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_s390x)
|
||||
BASE_IMAGE_cainjector-linux-ppc64le:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_ppc64le)
|
||||
BASE_IMAGE_cainjector-linux-arm:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm)
|
||||
|
||||
BASE_IMAGE_cmctl-linux-amd64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_amd64)
|
||||
BASE_IMAGE_cmctl-linux-arm64:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm64)
|
||||
BASE_IMAGE_cmctl-linux-s390x:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_s390x)
|
||||
BASE_IMAGE_cmctl-linux-ppc64le:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_ppc64le)
|
||||
BASE_IMAGE_cmctl-linux-arm:=$($(BASE_IMAGE_TYPE)_BASE_IMAGE_arm)
|
||||
|
||||
bin/containers:
|
||||
@mkdir -p $@
|
||||
|
||||
.PHONY: all-containers
|
||||
all-containers: cert-manager-controller-linux cert-manager-webhook-linux cert-manager-acmesolver-linux cert-manager-cainjector-linux cert-manager-ctl-linux
|
||||
|
||||
.PHONY: cert-manager-controller-linux
|
||||
cert-manager-controller-linux: bin/containers/cert-manager-controller-linux-amd64.tar.gz bin/containers/cert-manager-controller-linux-arm64.tar.gz bin/containers/cert-manager-controller-linux-s390x.tar.gz bin/containers/cert-manager-controller-linux-ppc64le.tar.gz bin/containers/cert-manager-controller-linux-arm.tar.gz
|
||||
|
||||
bin/containers/cert-manager-controller-linux-amd64.tar.gz bin/containers/cert-manager-controller-linux-arm64.tar.gz bin/containers/cert-manager-controller-linux-s390x.tar.gz bin/containers/cert-manager-controller-linux-ppc64le.tar.gz bin/containers/cert-manager-controller-linux-arm.tar.gz: bin/containers/cert-manager-controller-linux-%.tar.gz: bin/server/controller-linux-% hack/containers/Containerfile.controller bin/scratch/cert-manager.license bin/scratch/cert-manager.licenses_notice | bin/containers
|
||||
$(eval TAG := cert-manager-controller-$*:$(RELEASE_VERSION))
|
||||
$(eval BASE := $(BASE_IMAGE_$(notdir $<)))
|
||||
$(CTR) build --quiet \
|
||||
-f hack/containers/Containerfile.controller \
|
||||
--build-arg BASE_IMAGE=$(BASE) \
|
||||
--build-arg BINARY_PATH=$< \
|
||||
--build-arg LICENSE_PATH=bin/scratch/cert-manager.license \
|
||||
--build-arg LICENSES_PATH=bin/scratch/cert-manager.licenses_notice \
|
||||
-t $(TAG) \
|
||||
.
|
||||
$(CTR) save $(TAG) | gzip > $@
|
||||
|
||||
.PHONY: cert-manager-webhook-linux
|
||||
cert-manager-webhook-linux: bin/containers/cert-manager-webhook-linux-amd64.tar.gz bin/containers/cert-manager-webhook-linux-arm64.tar.gz bin/containers/cert-manager-webhook-linux-s390x.tar.gz bin/containers/cert-manager-webhook-linux-ppc64le.tar.gz bin/containers/cert-manager-webhook-linux-arm.tar.gz
|
||||
|
||||
bin/containers/cert-manager-webhook-linux-amd64.tar.gz bin/containers/cert-manager-webhook-linux-arm64.tar.gz bin/containers/cert-manager-webhook-linux-s390x.tar.gz bin/containers/cert-manager-webhook-linux-ppc64le.tar.gz bin/containers/cert-manager-webhook-linux-arm.tar.gz: bin/containers/cert-manager-webhook-linux-%.tar.gz: bin/server/webhook-linux-% hack/containers/Containerfile.webhook bin/scratch/cert-manager.license bin/scratch/cert-manager.licenses_notice | bin/containers
|
||||
$(eval TAG := cert-manager-webhook-$*:$(RELEASE_VERSION))
|
||||
$(eval BASE := BASE_IMAGE_$(notdir $<))
|
||||
$(CTR) build --quiet \
|
||||
-f hack/containers/Containerfile.webhook \
|
||||
--build-arg BASE_IMAGE=$($(BASE)) \
|
||||
--build-arg BINARY_PATH=$< \
|
||||
--build-arg LICENSE_PATH=bin/scratch/cert-manager.license \
|
||||
--build-arg LICENSES_PATH=bin/scratch/cert-manager.licenses_notice \
|
||||
-t $(TAG) \
|
||||
.
|
||||
$(CTR) save $(TAG) | gzip > $@
|
||||
|
||||
.PHONY: cert-manager-cainjector-linux
|
||||
cert-manager-cainjector-linux: bin/containers/cert-manager-cainjector-linux-amd64.tar.gz bin/containers/cert-manager-cainjector-linux-arm64.tar.gz bin/containers/cert-manager-cainjector-linux-s390x.tar.gz bin/containers/cert-manager-cainjector-linux-ppc64le.tar.gz bin/containers/cert-manager-cainjector-linux-arm.tar.gz
|
||||
|
||||
bin/containers/cert-manager-cainjector-linux-amd64.tar.gz bin/containers/cert-manager-cainjector-linux-arm64.tar.gz bin/containers/cert-manager-cainjector-linux-s390x.tar.gz bin/containers/cert-manager-cainjector-linux-ppc64le.tar.gz bin/containers/cert-manager-cainjector-linux-arm.tar.gz: bin/containers/cert-manager-cainjector-linux-%.tar.gz: bin/server/cainjector-linux-% hack/containers/Containerfile.cainjector bin/scratch/cert-manager.license bin/scratch/cert-manager.licenses_notice | bin/containers
|
||||
$(eval TAG := cert-manager-cainjector-$*:$(RELEASE_VERSION))
|
||||
$(eval BASE := BASE_IMAGE_$(notdir $<))
|
||||
$(CTR) build --quiet \
|
||||
-f hack/containers/Containerfile.cainjector \
|
||||
--build-arg BASE_IMAGE=$($(BASE)) \
|
||||
--build-arg BINARY_PATH=$< \
|
||||
--build-arg LICENSE_PATH=bin/scratch/cert-manager.license \
|
||||
--build-arg LICENSES_PATH=bin/scratch/cert-manager.licenses_notice \
|
||||
-t $(TAG) \
|
||||
.
|
||||
$(CTR) save $(TAG) | gzip > $@
|
||||
|
||||
.PHONY: cert-manager-acmesolver-linux
|
||||
cert-manager-acmesolver-linux: bin/containers/cert-manager-acmesolver-linux-amd64.tar.gz bin/containers/cert-manager-acmesolver-linux-arm64.tar.gz bin/containers/cert-manager-acmesolver-linux-s390x.tar.gz bin/containers/cert-manager-acmesolver-linux-ppc64le.tar.gz bin/containers/cert-manager-acmesolver-linux-arm.tar.gz
|
||||
|
||||
bin/containers/cert-manager-acmesolver-linux-amd64.tar.gz bin/containers/cert-manager-acmesolver-linux-arm64.tar.gz bin/containers/cert-manager-acmesolver-linux-s390x.tar.gz bin/containers/cert-manager-acmesolver-linux-ppc64le.tar.gz bin/containers/cert-manager-acmesolver-linux-arm.tar.gz: bin/containers/cert-manager-acmesolver-linux-%.tar.gz: bin/server/acmesolver-linux-% hack/containers/Containerfile.acmesolver bin/scratch/cert-manager.license bin/scratch/cert-manager.licenses_notice | bin/containers
|
||||
$(eval TAG := cert-manager-acmesolver-$*:$(RELEASE_VERSION))
|
||||
$(eval BASE := BASE_IMAGE_$(notdir $<))
|
||||
$(CTR) build --quiet \
|
||||
-f hack/containers/Containerfile.acmesolver \
|
||||
--build-arg BASE_IMAGE=$($(BASE)) \
|
||||
--build-arg BINARY_PATH=$< \
|
||||
--build-arg LICENSE_PATH=bin/scratch/cert-manager.license \
|
||||
--build-arg LICENSES_PATH=bin/scratch/cert-manager.licenses_notice \
|
||||
-t $(TAG) \
|
||||
.
|
||||
$(CTR) save $(TAG) | gzip > $@
|
||||
|
||||
.PHONY: cert-manager-ctl-linux
|
||||
cert-manager-ctl-linux: bin/containers/cert-manager-ctl-linux-amd64.tar.gz bin/containers/cert-manager-ctl-linux-arm64.tar.gz bin/containers/cert-manager-ctl-linux-s390x.tar.gz bin/containers/cert-manager-ctl-linux-ppc64le.tar.gz bin/containers/cert-manager-ctl-linux-arm.tar.gz
|
||||
|
||||
bin/containers/cert-manager-ctl-linux-amd64.tar.gz bin/containers/cert-manager-ctl-linux-arm64.tar.gz bin/containers/cert-manager-ctl-linux-s390x.tar.gz bin/containers/cert-manager-ctl-linux-ppc64le.tar.gz bin/containers/cert-manager-ctl-linux-arm.tar.gz: bin/containers/cert-manager-ctl-linux-%.tar.gz: bin/cmctl/cmctl-linux-% hack/containers/Containerfile.ctl bin/scratch/cert-manager.license bin/scratch/cert-manager.licenses_notice | bin/containers
|
||||
$(eval TAG := cert-manager-ctl-$*:$(RELEASE_VERSION))
|
||||
$(eval BASE := BASE_IMAGE_$(notdir $<))
|
||||
$(CTR) build --quiet \
|
||||
-f hack/containers/Containerfile.ctl \
|
||||
--build-arg BASE_IMAGE=$($(BASE)) \
|
||||
--build-arg BINARY_PATH=$< \
|
||||
--build-arg LICENSE_PATH=bin/scratch/cert-manager.license \
|
||||
--build-arg LICENSES_PATH=bin/scratch/cert-manager.licenses_notice \
|
||||
-t $(TAG) \
|
||||
.
|
||||
$(CTR) save $(TAG) | gzip > $@
|
||||
+14
@@ -0,0 +1,14 @@
|
||||
RELEASE_VERSION := $(shell git describe --tags)
|
||||
|
||||
GITCOMMIT := $(shell git rev-parse HEAD)
|
||||
|
||||
IS_TAGGED_RELEASE := $(shell git describe --exact-match HEAD >/dev/null 2>&1 && echo "true" || echo "false")
|
||||
|
||||
IS_PRERELEASE := $(shell echo $(RELEASE_VERSION) | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+$$' - && echo "false" || echo "true")
|
||||
|
||||
.PHONY: gitver
|
||||
gitver:
|
||||
@echo "Release version: \"$(RELEASE_VERSION)\""
|
||||
@echo "Is tagged release: \"$(IS_TAGGED_RELEASE)\""
|
||||
@echo "Is prerelease: \"$(IS_PRERELEASE)\""
|
||||
@echo "Git commit hash: \"$(GITCOMMIT)\""
|
||||
@@ -0,0 +1,23 @@
|
||||
# LICENSE_YEAR is the value which will be substituted into licenses when they're generated
|
||||
# It would be possible to make this more dynamic, but there's seemingly no need:
|
||||
# https://stackoverflow.com/a/2391555/1615417
|
||||
# As such, this is hardcoded to avoid needless complexity
|
||||
LICENSE_YEAR=2021
|
||||
|
||||
# Creates the boilerplate header for YAML files, assumed to be the same as the one in
|
||||
# shell scripts (hence the use of boilerplate.sh.txt)
|
||||
bin/scratch/license.yaml: hack/boilerplate/boilerplate.sh.txt | bin/scratch
|
||||
sed -e "s/YEAR/$(LICENSE_YEAR)/g" < $< > $@
|
||||
|
||||
# The references LICENSES file is 1.4MB at the time of writing. Bundling it into every container image
|
||||
# seems wasteful in terms of bytes stored and bytes transferred on the wire just to add a file
|
||||
# which presumably nobody will ever read or care about. Instead, just add a little footnote pointing
|
||||
# to the cert-manager repo in case anybody actually decides that they care.
|
||||
bin/scratch/license-footnote.yaml: | bin/scratch
|
||||
@echo -e "# To view licenses for cert-manager dependencies, see the LICENSES file in the\n# cert-manager repo: https://github.com/jetstack/cert-manager" > $@
|
||||
|
||||
bin/scratch/cert-manager.license: bin/scratch/license.yaml bin/scratch/license-footnote.yaml | bin/scratch
|
||||
cat $^ > $@
|
||||
|
||||
bin/scratch/cert-manager.licenses_notice: bin/scratch/license-footnote.yaml | bin/scratch
|
||||
cp $< $@
|
||||
@@ -0,0 +1,168 @@
|
||||
HELM_CMD=./bin/tools/helm
|
||||
|
||||
ALLCRDS=deploy/crds/crd-certificaterequests.yaml deploy/crds/crd-certificates.yaml deploy/crds/crd-challenges.yaml deploy/crds/crd-clusterissuers.yaml deploy/crds/crd-issuers.yaml deploy/crds/crd-orders.yaml
|
||||
|
||||
HELM_TEMPLATE_SOURCES=$(wildcard deploy/charts/cert-manager/templates/*.yaml)
|
||||
HELM_TEMPLATE_TARGETS=$(patsubst deploy/charts/cert-manager/templates/%,bin/helm/cert-manager/templates/%,$(HELM_TEMPLATE_SOURCES))
|
||||
|
||||
####################
|
||||
# Friendly Targets #
|
||||
####################
|
||||
|
||||
# These targets provide friendly names for the various manifests / charts we build
|
||||
|
||||
.PHONY: helm-chart
|
||||
helm-chart: bin/cert-manager-$(RELEASE_VERSION).tgz
|
||||
|
||||
.PHONY: helm-chart-signature
|
||||
helm-chart-signature: bin/cert-manager-$(RELEASE_VERSION).tgz.prov
|
||||
|
||||
.PHONY: static-manifests
|
||||
static-manifests: bin/yaml/cert-manager.crds.yaml bin/yaml/cert-manager.yaml
|
||||
|
||||
###################
|
||||
# Release Targets #
|
||||
###################
|
||||
|
||||
.PHONY: release-manifests
|
||||
release-manifests: bin/release/cert-manager-manifests.tar.gz bin/metadata/cert-manager-manifests.tar.gz.metadata.json
|
||||
|
||||
bin/release/cert-manager-manifests.tar.gz: bin/cert-manager-$(RELEASE_VERSION).tgz bin/yaml/cert-manager.crds.yaml bin/yaml/cert-manager.yaml bin/cert-manager-$(RELEASE_VERSION).tgz.prov | bin/scratch/manifests bin/release
|
||||
mkdir -p bin/scratch/manifests/deploy/chart/
|
||||
mkdir -p bin/scratch/manifests/deploy/manifests/
|
||||
cp bin/cert-manager-$(RELEASE_VERSION).tgz bin/cert-manager-$(RELEASE_VERSION).tgz.prov bin/scratch/manifests/deploy/chart/
|
||||
cp bin/yaml/cert-manager.crds.yaml bin/yaml/cert-manager.yaml bin/scratch/manifests/deploy/manifests/
|
||||
tar czf $@ -C bin/scratch/manifests .
|
||||
rm -rf bin/scratch/manifests
|
||||
|
||||
# This metadata blob is constructed slightly differently and doesn't use hack/artifact-metadata.template.json directly;
|
||||
# this is because the bazel staged releases didn't include an "os" or "architecture" field for this artifact
|
||||
bin/metadata/cert-manager-manifests.tar.gz.metadata.json: bin/release/cert-manager-manifests.tar.gz hack/artifact-metadata.template.json | bin/metadata
|
||||
jq -n --arg name "$(notdir $<)" \
|
||||
--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
|
||||
'.name = $$name | .sha256 = $$sha256' > $@
|
||||
|
||||
################
|
||||
# Helm Targets #
|
||||
################
|
||||
|
||||
# These targets provide for building and signing the cert-manager helm chart.
|
||||
|
||||
bin/cert-manager-$(RELEASE_VERSION).tgz: bin/helm/cert-manager/README.md bin/helm/cert-manager/Chart.yaml bin/helm/cert-manager/values.yaml $(HELM_TEMPLATE_TARGETS) bin/helm/cert-manager/templates/NOTES.txt bin/helm/cert-manager/templates/_helpers.tpl | bin/helm/cert-manager bin/tools/helm
|
||||
$(HELM_CMD) package --app-version=$(RELEASE_VERSION) --version=$(RELEASE_VERSION) --destination "$(dir $@)" ./bin/helm/cert-manager
|
||||
|
||||
bin/cert-manager-$(RELEASE_VERSION).tgz.prov: bin/cert-manager-$(RELEASE_VERSION).tgz | bin/helm/cert-manager bin/tools/cmrel
|
||||
ifeq ($(strip $(CMREL_KEY)),)
|
||||
$(error Trying to sign helm chart but CMREL_KEY is empty)
|
||||
endif
|
||||
cd $(dir $<) && $(CMREL) sign helm --chart-path "$(notdir $<)" --key "$(CMREL_KEY)"
|
||||
|
||||
$(HELM_TEMPLATE_TARGETS): $(HELM_TEMPLATE_SOURCES) | bin/helm/cert-manager/templates
|
||||
cp -f $^ $(dir $@)
|
||||
|
||||
bin/helm/cert-manager/templates/_helpers.tpl: deploy/charts/cert-manager/templates/_helpers.tpl | bin/helm/cert-manager/templates
|
||||
cp $< $@
|
||||
|
||||
bin/helm/cert-manager/templates/NOTES.txt: deploy/charts/cert-manager/templates/NOTES.txt | bin/helm/cert-manager/templates
|
||||
cp $< $@
|
||||
|
||||
bin/helm/cert-manager/values.yaml: deploy/charts/cert-manager/values.yaml | bin/helm/cert-manager
|
||||
cp $< $@
|
||||
|
||||
bin/helm/cert-manager/README.md: deploy/charts/cert-manager/README.template.md | bin/helm/cert-manager
|
||||
sed -e "s:{{RELEASE_VERSION}}:$(RELEASE_VERSION):g" < $< > $@
|
||||
|
||||
bin/helm/cert-manager/Chart.yaml: deploy/charts/cert-manager/Chart.template.yaml deploy/charts/cert-manager/signkey_annotation.txt | bin/helm/cert-manager bin/tools/yq
|
||||
@# this horrible mess is taken from the YQ manual's example of multiline string blocks from a file:
|
||||
@# https://mikefarah.gitbook.io/yq/operators/string-operators#string-blocks-bash-and-newlines
|
||||
@# we set a bash variable called SIGNKEY_ANNOTATION using read, and then use that bash variable in yq
|
||||
IFS= read -rd '' SIGNKEY_ANNOTATION < <(cat deploy/charts/cert-manager/signkey_annotation.txt) ; \
|
||||
SIGNKEY_ANNOTATION=$$SIGNKEY_ANNOTATION $(YQ) eval \
|
||||
'.annotations."artifacthub.io/signKey" = strenv(SIGNKEY_ANNOTATION) | .annotations."artifacthub.io/prerelease" = "$(IS_PRERELEASE)" | .version = "$(RELEASE_VERSION)" | .appVersion = "$(RELEASE_VERSION)"' \
|
||||
$< > $@
|
||||
|
||||
#################################
|
||||
# Targets for cert-manager.yaml #
|
||||
#################################
|
||||
|
||||
# These targets depend on the cert-manager helm chart and the creation of the standalone CRDs.
|
||||
# They use `helm template` to create a single static YAML manifest containing all resources
|
||||
# with templating completed, and then concatenate with the cert-manager namespace and the CRDs.
|
||||
|
||||
bin/yaml/cert-manager.yaml: bin/scratch/license.yaml deploy/manifests/namespace.yaml bin/scratch/yaml/cert-manager.crds.unlicensed.yaml bin/scratch/yaml/cert-manager-static-resources.yaml | bin/yaml
|
||||
@# NB: filter-out removes the license (the first dependency, $<) from the YAML concatenation
|
||||
./hack/concat-yaml.sh $(filter-out $<, $^) | cat $< - > $@
|
||||
|
||||
# Renders all resources except the namespace and the CRDs
|
||||
bin/scratch/yaml/cert-manager-static-resources.yaml: bin/cert-manager-$(RELEASE_VERSION).tgz | bin/scratch/yaml bin/tools/helm
|
||||
# The sed command removes the first line but only if it matches "---", which helm adds
|
||||
$(HELM_CMD) template --api-versions="" --namespace=cert-manager --set="creator=static" --set="startupapicheck.enabled=false" cert-manager $< | \
|
||||
sed -e "1{/^---$$/d;}" > $@
|
||||
|
||||
######################################
|
||||
# Targets for cert-manager.crds.yaml #
|
||||
######################################
|
||||
|
||||
# These targets generate a dummy helm chart containing _only_ our CRDs, and then uses `helm template`
|
||||
# to create a single YAML file containing all CRDS with the templating completed
|
||||
|
||||
# CRDs with a license
|
||||
bin/yaml/cert-manager.crds.yaml: bin/scratch/license.yaml bin/scratch/yaml/cert-manager.crds.unlicensed.yaml | bin/yaml
|
||||
cat $^ > $@
|
||||
|
||||
bin/scratch/yaml/cert-manager.crds.unlicensed.yaml: bin/scratch/cert-manager-crds/cert-manager-$(RELEASE_VERSION).tgz | bin/scratch/yaml bin/tools/helm
|
||||
# The sed command removes the first line but only if it matches "---", which helm adds
|
||||
$(HELM_CMD) template --api-versions="" --namespace=cert-manager --set="creator=static" --set="startupapicheck.enabled=false" cert-manager $< | \
|
||||
sed -e "1{/^---$$/d;}" > $@
|
||||
|
||||
bin/scratch/cert-manager-crds/cert-manager-$(RELEASE_VERSION).tgz: bin/helm/cert-manager-crds/templates/_helpers.tpl bin/helm/cert-manager-crds/templates/crd-templates.yaml bin/helm/cert-manager-crds/README.md bin/helm/cert-manager-crds/Chart.yaml bin/helm/cert-manager-crds/values.yaml | bin/scratch bin/tools/helm
|
||||
$(HELM_CMD) package --app-version=$(RELEASE_VERSION) --version=$(RELEASE_VERSION) --destination "$(dir $@)" ./bin/helm/cert-manager-crds
|
||||
|
||||
# create a temporary chart containing the cert-manager CRDs in order to use helm's
|
||||
# templating engine to create usable CRDs for static installation
|
||||
bin/helm/cert-manager-crds/Chart.yaml: deploy/charts/cert-manager/Chart.template.yaml | bin/helm/cert-manager-crds
|
||||
sed -e "s:{{IS_PRERELEASE}}:$(IS_PRERELEASE):g" \
|
||||
-e "s:{{RELEASE_VERSION}}:$(RELEASE_VERSION):g" < $< > $@
|
||||
|
||||
bin/helm/cert-manager-crds/README.md: | bin/helm/cert-manager-crds
|
||||
@echo "This chart is a cert-manager build artifact, do not use" > $@
|
||||
|
||||
bin/helm/cert-manager-crds/values.yaml: deploy/charts/cert-manager/values.yaml | bin/helm/cert-manager
|
||||
cp $< $@
|
||||
|
||||
bin/helm/cert-manager-crds/templates/_helpers.tpl: deploy/charts/cert-manager/templates/_helpers.tpl | bin/helm/cert-manager-crds/templates
|
||||
cp $< $@
|
||||
|
||||
bin/helm/cert-manager-crds/templates/crd-templates.yaml: bin/scratch/yaml/cert-manager-crd-templates.yaml | bin/helm/cert-manager-crds/templates
|
||||
cp $< $@
|
||||
|
||||
# Create a single file containing all CRDs before they've been templated
|
||||
bin/scratch/yaml/cert-manager-crd-templates.yaml: $(ALLCRDS) | bin/scratch/yaml
|
||||
./hack/concat-yaml.sh $^ > $@
|
||||
|
||||
###############
|
||||
# Dir targets #
|
||||
###############
|
||||
|
||||
# These targets are trivial, to ensure that dirs exist
|
||||
|
||||
bin/yaml:
|
||||
@mkdir -p $@
|
||||
|
||||
bin/helm/cert-manager:
|
||||
@mkdir -p $@
|
||||
|
||||
bin/helm/cert-manager/templates:
|
||||
@mkdir -p $@
|
||||
|
||||
bin/helm/cert-manager-crds:
|
||||
@mkdir -p $@
|
||||
|
||||
bin/helm/cert-manager-crds/templates:
|
||||
@mkdir -p $@
|
||||
|
||||
bin/scratch/yaml:
|
||||
@mkdir -p $@
|
||||
|
||||
bin/scratch/manifests:
|
||||
@mkdir -p $@
|
||||
@@ -0,0 +1,37 @@
|
||||
.PHONY: release-containers
|
||||
release-containers: release-container-bundles release-container-metadata
|
||||
|
||||
.PHONY: release-container-bundles
|
||||
release-container-bundles: bin/release/cert-manager-server-linux-amd64.tar.gz bin/release/cert-manager-server-linux-arm64.tar.gz bin/release/cert-manager-server-linux-s390x.tar.gz bin/release/cert-manager-server-linux-ppc64le.tar.gz bin/release/cert-manager-server-linux-arm.tar.gz
|
||||
|
||||
bin/release/cert-manager-server-linux-amd64.tar.gz bin/release/cert-manager-server-linux-arm64.tar.gz bin/release/cert-manager-server-linux-s390x.tar.gz bin/release/cert-manager-server-linux-ppc64le.tar.gz bin/release/cert-manager-server-linux-arm.tar.gz: bin/release/cert-manager-server-linux-%.tar.gz: bin/containers/cert-manager-acmesolver-linux-%.tar.gz bin/containers/cert-manager-cainjector-linux-%.tar.gz bin/containers/cert-manager-controller-linux-%.tar.gz bin/containers/cert-manager-webhook-linux-%.tar.gz bin/containers/cert-manager-ctl-linux-%.tar.gz bin/scratch/cert-manager.license | bin/release bin/scratch
|
||||
@# use basename twice to strip both "tar" and "gz"
|
||||
$(eval CTR_BASENAME := $(basename $(basename $(notdir $@))))
|
||||
$(eval CTR_SCRATCHDIR := bin/scratch/release-container-bundle/$(CTR_BASENAME))
|
||||
mkdir -p $(CTR_SCRATCHDIR)/server/images
|
||||
echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/version
|
||||
echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/acmesolver.docker_tag
|
||||
echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/cainjector.docker_tag
|
||||
echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/controller.docker_tag
|
||||
echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/webhook.docker_tag
|
||||
echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/ctl.docker_tag
|
||||
cp bin/scratch/cert-manager.license $(CTR_SCRATCHDIR)/LICENSES
|
||||
gunzip -c bin/containers/cert-manager-acmesolver-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/acmesolver.tar
|
||||
gunzip -c bin/containers/cert-manager-cainjector-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/cainjector.tar
|
||||
gunzip -c bin/containers/cert-manager-controller-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/controller.tar
|
||||
gunzip -c bin/containers/cert-manager-webhook-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/webhook.tar
|
||||
gunzip -c bin/containers/cert-manager-ctl-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/ctl.tar
|
||||
chmod -R 755 $(CTR_SCRATCHDIR)/server/images/*
|
||||
tar czf $@ -C bin/scratch/release-container-bundle $(CTR_BASENAME)
|
||||
rm -rf $(CTR_SCRATCHDIR)
|
||||
|
||||
.PHONY: release-container-metadata
|
||||
release-container-metadata: bin/metadata/cert-manager-server-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-arm.tar.gz.metadata.json
|
||||
|
||||
bin/metadata/cert-manager-server-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-arm.tar.gz.metadata.json: bin/metadata/cert-manager-server-linux-%.tar.gz.metadata.json: bin/release/cert-manager-server-linux-%.tar.gz hack/artifact-metadata.template.json | bin/metadata
|
||||
jq --arg name "$(notdir $<)" \
|
||||
--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
|
||||
--arg os "linux" \
|
||||
--arg architecture "$*" \
|
||||
'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
|
||||
hack/artifact-metadata.template.json > $@
|
||||
@@ -0,0 +1,77 @@
|
||||
.PHONY: server-binaries
|
||||
server-binaries: controller acmesolver webhook cainjector
|
||||
|
||||
bin/server:
|
||||
@mkdir -p $@
|
||||
|
||||
.PHONY: controller
|
||||
controller: bin/server/controller-linux-amd64 bin/server/controller-linux-arm64 bin/server/controller-linux-s390x bin/server/controller-linux-ppc64le bin/server/controller-linux-arm | bin/server
|
||||
|
||||
bin/server/controller-linux-amd64: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=amd64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/controller/main.go
|
||||
|
||||
bin/server/controller-linux-arm64: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=arm64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/controller/main.go
|
||||
|
||||
bin/server/controller-linux-s390x: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=s390x $(GOBUILD) -o $@ $(GOFLAGS) cmd/controller/main.go
|
||||
|
||||
bin/server/controller-linux-ppc64le: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=ppc64le $(GOBUILD) -o $@ $(GOFLAGS) cmd/controller/main.go
|
||||
|
||||
bin/server/controller-linux-arm: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(GOFLAGS) cmd/controller/main.go
|
||||
|
||||
.PHONY: acmesolver
|
||||
acmesolver: bin/server/acmesolver-linux-amd64 bin/server/acmesolver-linux-arm64 bin/server/acmesolver-linux-s390x bin/server/acmesolver-linux-ppc64le bin/server/acmesolver-linux-arm | bin/server
|
||||
|
||||
bin/server/acmesolver-linux-amd64: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=amd64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/acmesolver/main.go
|
||||
|
||||
bin/server/acmesolver-linux-arm64: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=arm64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/acmesolver/main.go
|
||||
|
||||
bin/server/acmesolver-linux-s390x: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=s390x $(GOBUILD) -o $@ $(GOFLAGS) cmd/acmesolver/main.go
|
||||
|
||||
bin/server/acmesolver-linux-ppc64le: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=ppc64le $(GOBUILD) -o $@ $(GOFLAGS) cmd/acmesolver/main.go
|
||||
|
||||
bin/server/acmesolver-linux-arm: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(GOFLAGS) cmd/acmesolver/main.go
|
||||
|
||||
.PHONY: webhook
|
||||
webhook: bin/server/webhook-linux-amd64 bin/server/webhook-linux-arm64 bin/server/webhook-linux-s390x bin/server/webhook-linux-ppc64le bin/server/webhook-linux-arm | bin/server
|
||||
|
||||
bin/server/webhook-linux-amd64: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=amd64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/webhook/main.go
|
||||
|
||||
bin/server/webhook-linux-arm64: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=arm64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/webhook/main.go
|
||||
|
||||
bin/server/webhook-linux-s390x: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=s390x $(GOBUILD) -o $@ $(GOFLAGS) cmd/webhook/main.go
|
||||
|
||||
bin/server/webhook-linux-ppc64le: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=ppc64le $(GOBUILD) -o $@ $(GOFLAGS) cmd/webhook/main.go
|
||||
|
||||
bin/server/webhook-linux-arm: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(GOFLAGS) cmd/webhook/main.go
|
||||
|
||||
.PHONY: cainjector
|
||||
cainjector: bin/server/cainjector-linux-amd64 bin/server/cainjector-linux-arm64 bin/server/cainjector-linux-s390x bin/server/cainjector-linux-ppc64le bin/server/cainjector-linux-arm | bin/server
|
||||
|
||||
bin/server/cainjector-linux-amd64: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=amd64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/cainjector/main.go
|
||||
|
||||
bin/server/cainjector-linux-arm64: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=arm64 $(GOBUILD) -o $@ $(GOFLAGS) cmd/cainjector/main.go
|
||||
|
||||
bin/server/cainjector-linux-s390x: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=s390x $(GOBUILD) -o $@ $(GOFLAGS) cmd/cainjector/main.go
|
||||
|
||||
bin/server/cainjector-linux-ppc64le: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=ppc64le $(GOBUILD) -o $@ $(GOFLAGS) cmd/cainjector/main.go
|
||||
|
||||
bin/server/cainjector-linux-arm: $(SOURCES) | bin/server
|
||||
GOOS=linux GOARCH=arm GOARM=7 $(GOBUILD) -o $@ $(GOFLAGS) cmd/cainjector/main.go
|
||||
+142
@@ -0,0 +1,142 @@
|
||||
GO=go
|
||||
CGO_ENABLED ?= 0
|
||||
GOBUILD=CGO_ENABLED=$(CGO_ENABLED) GOMAXPROCS=$(GOBUILDPROCS) $(GO) build
|
||||
|
||||
CTR=docker
|
||||
|
||||
WORKDIR=$(shell pwd)
|
||||
HELM=$(WORKDIR)/bin/tools/helm
|
||||
COSIGN=$(WORKDIR)/bin/tools/cosign
|
||||
CMREL=$(WORKDIR)/bin/tools/cmrel
|
||||
YQ=$(WORKDIR)/bin/tools/yq
|
||||
|
||||
HELM_VERSION=3.6.3
|
||||
KUBECTL_VERSION=1.22.1
|
||||
KIND_VERSION=0.11.1
|
||||
COSIGN_VERSION=1.3.1
|
||||
CMREL_VERSION=a1e2bad95be9688794fd0571c4c40e88cccf9173
|
||||
K8S_RELEASE_NOTES_VERSION=0.7.0
|
||||
YTT_VERSION=0.36.0
|
||||
YQ_VERSION=4.11.2
|
||||
|
||||
bin/tools:
|
||||
@mkdir -p $@
|
||||
|
||||
bin/scratch/tools:
|
||||
@mkdir -p $@
|
||||
|
||||
.PHONY: tools
|
||||
tools: bin/tools/helm bin/tools/kubectl bin/tools/kind bin/tools/cosign bin/tools/release-notes bin/tools/cmrel bin/tools/ytt bin/tools/yq
|
||||
|
||||
########
|
||||
# Helm #
|
||||
########
|
||||
|
||||
HELM_linux_amd64_SHA256SUM=07c100849925623dc1913209cd1a30f0a9b80a5b4d6ff2153c609d11b043e262
|
||||
HELM_darwin_amd64_SHA256SUM=84a1ff17dd03340652d96e8be5172a921c97825fd278a2113c8233a4e8db5236
|
||||
HELM_darwin_arm64_SHA256SUM=a50b499dbd0bbec90761d50974bf1e67cc6d503ea20d03b4a1275884065b7e9e
|
||||
|
||||
bin/tools/helm: bin/scratch/tools/helm-v$(HELM_VERSION)-$(HOST_OS)-$(HOST_ARCH).tar.gz | bin/tools
|
||||
@# O writes the specified file to stdout
|
||||
tar xfO $< $(HOST_OS)-$(HOST_ARCH)/helm > $@
|
||||
chmod +x $@
|
||||
|
||||
bin/scratch/tools/helm-v$(HELM_VERSION)-$(HOST_OS)-$(HOST_ARCH).tar.gz: | bin/scratch/tools
|
||||
curl -sSfL https://get.helm.sh/helm-v$(HELM_VERSION)-$(HOST_OS)-$(HOST_ARCH).tar.gz > $@
|
||||
./hack/util/checkhash.sh $@ $(HELM_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
|
||||
|
||||
###########
|
||||
# kubectl #
|
||||
###########
|
||||
|
||||
KUBECTL_linux_amd64_SHA256SUM=78178a8337fc6c76780f60541fca7199f0f1a2e9c41806bded280a4a5ef665c9
|
||||
KUBECTL_darwin_amd64_SHA256SUM=00bb3947ac6ff15690f90ee1a732d0a9a44360fc7743dbfee4cba5a8f6a31413
|
||||
KUBECTL_darwin_arm64_SHA256SUM=c81a314ab7f0827a5376f8ffd6d47f913df046275d44c562915a822229819d77
|
||||
|
||||
bin/tools/kubectl: bin/scratch/tools/kubectl_$(HOST_OS)_$(HOST_ARCH) | bin/tools
|
||||
cp $< $@
|
||||
chmod +x $@
|
||||
|
||||
bin/scratch/tools/kubectl_$(HOST_OS)_$(HOST_ARCH): | bin/scratch/tools
|
||||
curl -sSfL https://storage.googleapis.com/kubernetes-release/release/v$(KUBECTL_VERSION)/bin/$(HOST_OS)/$(HOST_ARCH)/kubectl > $@
|
||||
./hack/util/checkhash.sh $@ $(KUBECTL_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
|
||||
|
||||
########
|
||||
# kind #
|
||||
########
|
||||
|
||||
KIND_linux_amd64_SHA256SUM=949f81b3c30ca03a3d4effdecda04f100fa3edc07a28b19400f72ede7c5f0491
|
||||
KIND_darwin_amd64_SHA256SUM=432bef555a70e9360b44661c759658265b9eaaf7f75f1beec4c4d1e6bbf97ce3
|
||||
KIND_darwin_arm64_SHA256SUM=4f019c578600c087908ac59dd0c4ce1791574f153a70608adb372d5abc58cd47
|
||||
|
||||
bin/tools/kind: bin/scratch/tools/kind_$(HOST_OS)_$(HOST_ARCH) | bin/tools
|
||||
cp $< $@
|
||||
chmod +x $@
|
||||
|
||||
bin/scratch/tools/kind_$(HOST_OS)_$(HOST_ARCH): | bin/scratch/tools
|
||||
curl -sSfL https://github.com/kubernetes-sigs/kind/releases/download/v$(KIND_VERSION)/kind-$(HOST_OS)-$(HOST_ARCH) > $@
|
||||
./hack/util/checkhash.sh $@ $(KIND_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
|
||||
|
||||
##########
|
||||
# cosign #
|
||||
##########
|
||||
|
||||
COSIGN_linux_amd64_SHA256SUM=1227b270e5d7d21d09469253cce17b72a14f6b7c9036dfc09698c853b31e8fc8
|
||||
COSIGN_darwin_amd64_SHA256SUM=bcffa19e80f3e94d70e1fb1b0f591b0dec08926b31d3609fe3d25a1cc0389a0a
|
||||
COSIGN_darwin_arm64_SHA256SUM=eda58f090d8f4f1db5a0e3a0d2d8845626181fe8aa1cea1791e0afa87fee7b5c
|
||||
|
||||
bin/tools/cosign: bin/scratch/tools/cosign_$(HOST_OS)_$(HOST_ARCH) | bin/tools
|
||||
cp $< $@
|
||||
chmod +x $@
|
||||
|
||||
# TODO: cosign also provides signatures on all of its binaries, but they can't be validated without already having cosign
|
||||
# available! We could do something like "if system cosign is available, verify using that", but for now we'll skip
|
||||
bin/scratch/tools/cosign_$(HOST_OS)_$(HOST_ARCH): | bin/scratch/tools
|
||||
curl -sSfL https://github.com/sigstore/cosign/releases/download/v$(COSIGN_VERSION)/cosign-$(HOST_OS)-$(HOST_ARCH) > $@
|
||||
./hack/util/checkhash.sh $@ $(COSIGN_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
|
||||
|
||||
#########
|
||||
# cmrel #
|
||||
#########
|
||||
|
||||
bin/tools/cmrel: | bin/tools
|
||||
GOBIN=$(shell pwd)/$(dir $@) go install github.com/cert-manager/release/cmd/cmrel@$(CMREL_VERSION)
|
||||
|
||||
#################
|
||||
# release-notes #
|
||||
#################
|
||||
|
||||
bin/tools/release-notes: | bin/tools
|
||||
GOBIN=$(shell pwd)/$(dir $@) go install k8s.io/release/cmd/release-notes@v$(K8S_RELEASE_NOTES_VERSION)
|
||||
|
||||
#######
|
||||
# ytt #
|
||||
#######
|
||||
|
||||
YTT_linux_amd64_SHA256SUM=d81ecf6c47209f6ac527e503a6fd85e999c3c2f8369e972794047bddc7e5fbe2
|
||||
YTT_darwin_amd64_SHA256SUM=9662e3f8e30333726a03f7a5ae6231fbfb2cebb6c1aa3f545b253d7c695487e6
|
||||
YTT_darwin_arm64_SHA256SUM=c970b2c13d4059f0bee3bf3ceaa09bd0674a62c24550453d90b284d885a06b7b
|
||||
|
||||
bin/tools/ytt: bin/scratch/tools/ytt_$(HOST_OS)_$(HOST_ARCH) | bin/tools
|
||||
cp $< $@
|
||||
chmod +x $@
|
||||
|
||||
bin/scratch/tools/ytt_$(HOST_OS)_$(HOST_ARCH): | bin/scratch/tools
|
||||
curl -sSfL https://github.com/vmware-tanzu/carvel-ytt/releases/download/v$(YTT_VERSION)/ytt-$(HOST_OS)-$(HOST_ARCH) > $@
|
||||
./hack/util/checkhash.sh $@ $(YTT_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
|
||||
|
||||
######
|
||||
# yq #
|
||||
######
|
||||
|
||||
YQ_linux_amd64_SHA256SUM=6b891fd5bb13820b2f6c1027b613220a690ce0ef4fc2b6c76ec5f643d5535e61
|
||||
YQ_darwin_amd64_SHA256SUM=5af6162d858b1adc4ad23ef11dff19ede5565d8841ac611b09500f6741ff7f46
|
||||
YQ_darwin_arm64_SHA256SUM=665ae1af7c73866cba74dd878c12ac49c091b66e46c9ed57d168b43955f5dd69
|
||||
|
||||
bin/tools/yq: bin/scratch/tools/yq_$(HOST_OS)_$(HOST_ARCH) | bin/tools
|
||||
cp $< $@
|
||||
chmod +x $@
|
||||
|
||||
bin/scratch/tools/yq_$(HOST_OS)_$(HOST_ARCH): | bin/scratch/tools
|
||||
curl -sSfL https://github.com/mikefarah/yq/releases/download/v$(YQ_VERSION)/yq_$(HOST_OS)_$(HOST_ARCH) > $@
|
||||
./hack/util/checkhash.sh $@ $(YQ_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM)
|
||||
Reference in New Issue
Block a user