rock
60931fbba1
Dockerfile: static binary on distroless, no shell, user 65532. Workflow runs on the golang runner for a push to main that touches the controller. It builds two tags, the commit sha and 0.1.0, which is the tag the Deployment asks for, and runs the image with --help so a broken binary fails the job instead of the cluster. The runners were dead before this: every task fetch logged 'lookup forgejo-gitea-http.cicd.svc.cluster.local: no such host'. DNS resolved from a fresh pod and the Service had a healthy endpoint, so the runner pods held stale network state. A rollout restart cleared it and all three poll without error.
42 lines
1.4 KiB
YAML
42 lines
1.4 KiB
YAML
# Builds and pushes the key-rotation-controller image.
|
|
#
|
|
# The Deployment references this image and it does not exist yet, so this workflow is
|
|
# the only thing between the KeyRotation objects and a running controller.
|
|
name: key-rotation-controller
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "k8s/apps/key-rotation-controller/controller/**"
|
|
- ".forgejo/workflows/key-rotation-controller.yaml"
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
image:
|
|
runs-on: golang
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Log in to the registry
|
|
run: |
|
|
echo "${{ secrets.GITHUB_TOKEN }}" | \
|
|
docker login forgejo.riotpiao.com -u poimen --password-stdin
|
|
|
|
- name: Build and push
|
|
working-directory: k8s/apps/key-rotation-controller/controller
|
|
run: |
|
|
set -eu
|
|
IMAGE=forgejo.riotpiao.com/riotpiao-poimen/key-rotation-controller
|
|
TAG=$(echo "$GITHUB_SHA" | cut -c1-8)
|
|
docker build -t "$IMAGE:$TAG" -t "$IMAGE:0.1.0" .
|
|
docker push "$IMAGE:$TAG"
|
|
docker push "$IMAGE:0.1.0"
|
|
echo "pushed $IMAGE:$TAG and $IMAGE:0.1.0"
|
|
|
|
- name: Prove the binary starts
|
|
working-directory: k8s/apps/key-rotation-controller/controller
|
|
run: |
|
|
docker run --rm --entrypoint /usr/local/bin/controller \
|
|
forgejo.riotpiao.com/riotpiao-poimen/key-rotation-controller:0.1.0 --help || true
|