commit 61b28174285a339c5b107969564e0d99cc6e426b
parent 249270db26fa89721d73fbd36e952fa4bc5b8edc
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Thu, 9 Apr 2026 12:34:28 +0200
fix rest of the files
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
3 files changed, 46 insertions(+), 170 deletions(-)
diff --git a/apps/talos_cluster/image-builder/build-blog-cronjob.yaml b/apps/talos_cluster/image-builder/build-blog-cronjob.yaml
@@ -16,42 +16,6 @@ spec:
serviceAccountName: image-builder-cronjob
restartPolicy: Never
initContainers:
- # Stage buildctl binary from the official buildkit image
- - name: setup-buildctl
- image: moby/buildkit:v0.29.0
- command: [cp, /usr/bin/buildctl, /tools/buildctl]
- volumeMounts:
- - name: tools
- mountPath: /tools
-
- # Download cosign binary (distroless image has no cp, so wget from releases)
- - name: setup-cosign
- image: alpine:3
- command:
- - /bin/sh
- - -c
- - |
- wget -qO /tools/cosign https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-amd64 \
- && chmod +x /tools/cosign
- volumeMounts:
- - name: tools
- mountPath: /tools
-
- # Download crane binary
- - name: setup-crane
- image: alpine:3
- command:
- - /bin/sh
- - -c
- - |
- wget -qO /tmp/crane.tar.gz https://github.com/google/go-containerregistry/releases/download/v0.21.4/go-containerregistry_Linux_x86_64.tar.gz \
- && tar -xzf /tmp/crane.tar.gz -C /tools crane \
- && chmod +x /tools/crane
- volumeMounts:
- - name: tools
- mountPath: /tools
-
- # Clone the gitops repo to get the Dockerfile
- name: clone-repo
image: alpine/git:latest
command:
@@ -72,10 +36,8 @@ spec:
- -c
- |
set -eu
- apk add --no-cache git >/dev/null
- export PATH="/tools:$PATH"
+ apk add --no-cache podman cosign >/dev/null
- # Registry auth for crane and cosign (buildkitd uses its own mounted config)
mkdir -p /root/.docker
cp /registry-secret/dockerconfig.json /root/.docker/config.json
@@ -85,31 +47,29 @@ spec:
echo "==> Building ${IMAGE}:${TAG_TS}"
- buildctl \
- --addr tcp://buildkitd.image-builder.svc.cluster.local:1234 \
- build \
- --frontend dockerfile.v0 \
- --opt platform=linux/amd64,linux/arm64 \
- --local context=/workspace/apps/talos_cluster/blog/docker \
- --local dockerfile=/workspace/apps/talos_cluster/blog/docker \
- --output "type=image,name=${IMAGE}:${TAG_TS},push=true,oci-mediatypes=true" \
- --metadata-file /tmp/build-meta.json
+ podman build \
+ --platform linux/amd64,linux/arm64 \
+ --manifest "${IMAGE}:${TAG_TS}" \
+ -f /workspace/apps/talos_cluster/blog/docker/Dockerfile \
+ /workspace/apps/talos_cluster/blog/docker
- DIGEST="$(crane digest ${IMAGE}:${TAG_TS})"
- echo "==> Digest: ${DIGEST}"
+ podman manifest push --all "${IMAGE}:${TAG_TS}" "docker://${IMAGE}:${TAG_TS}"
+ podman tag "${IMAGE}:${TAG_TS}" "${IMAGE}:latest"
+ podman tag "${IMAGE}:${TAG_TS}" "${IMAGE}:${TAG_SHA}"
+ podman push "${IMAGE}:latest"
+ podman push "${IMAGE}:${TAG_SHA}"
- # Add convenience tags (does not re-push layers, registry-side copy)
- crane cp "${IMAGE}:${TAG_TS}" "${IMAGE}:latest"
- crane cp "${IMAGE}:${TAG_TS}" "${IMAGE}:${TAG_SHA}"
+ DIGEST="$(podman inspect --format='{{.RepoDigests}}' ${IMAGE}:${TAG_TS} | grep -o 'sha256:[^@]*' | cut -d: -f2)"
+ [ -z "$DIGEST" ] && echo "Failed to get digest" && exit 1
+ echo "==> Digest: sha256:${DIGEST}"
- # Sign the manifest index
COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
cosign sign --yes \
--key /cosign-secret/cosign.key \
--new-bundle-format=false \
--use-signing-config=false \
--registry-referrers-mode=oci-1-1 \
- "${IMAGE}@${DIGEST}"
+ "${IMAGE}@sha256:${DIGEST}"
echo "==> Done: ${IMAGE}:${TAG_TS}"
env:
@@ -118,8 +78,6 @@ spec:
- name: COSIGN_EXPERIMENTAL
value: "1"
volumeMounts:
- - name: tools
- mountPath: /tools
- name: workspace
mountPath: /workspace
readOnly: true
@@ -131,8 +89,6 @@ spec:
readOnly: true
volumes:
- - name: tools
- emptyDir: {}
- name: workspace
emptyDir: {}
- name: registry-secret
diff --git a/apps/talos_cluster/image-builder/build-bookwyrm-cronjob.yaml b/apps/talos_cluster/image-builder/build-bookwyrm-cronjob.yaml
@@ -17,8 +17,6 @@ spec:
restartPolicy: OnFailure
initContainers:
# Step 1: Check upstream version and whether it already exists in registry.
- # Writes the upstream version to /workspace/version.
- # Writes /workspace/skip if the tag already exists (nothing to do).
- name: check-version
image: alpine:3
command:
@@ -51,40 +49,7 @@ spec:
- name: workspace
mountPath: /workspace
- # Step 2: Stage build tools (always runs; harmless if build is skipped)
- - name: setup-buildctl
- image: moby/buildkit:v0.29.0
- command: [cp, /usr/bin/buildctl, /tools/buildctl]
- volumeMounts:
- - name: tools
- mountPath: /tools
-
- - name: setup-cosign
- image: alpine:3
- command:
- - /bin/sh
- - -c
- - |
- wget -qO /tools/cosign https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-amd64 \
- && chmod +x /tools/cosign
- volumeMounts:
- - name: tools
- mountPath: /tools
-
- - name: setup-crane
- image: alpine:3
- command:
- - /bin/sh
- - -c
- - |
- wget -qO /tmp/crane.tar.gz https://github.com/google/go-containerregistry/releases/download/v0.21.4/go-containerregistry_Linux_x86_64.tar.gz \
- && tar -xzf /tmp/crane.tar.gz -C /tools crane \
- && chmod +x /tools/crane
- volumeMounts:
- - name: tools
- mountPath: /tools
-
- # Step 3: Clone gitops repo to get the dockerfile.patch
+ # Step 2: Clone gitops repo to get the dockerfile.patch
- name: clone-gitops
image: alpine/git:latest
command:
@@ -97,8 +62,7 @@ spec:
- name: workspace
mountPath: /workspace
- # Step 4: Clone upstream bookwyrm at the detected version and apply patch.
- # Skips everything if /workspace/skip exists.
+ # Step 3: Clone upstream bookwyrm at the detected version and apply patch.
- name: clone-bookwyrm
image: alpine/git:latest
command:
@@ -125,7 +89,7 @@ spec:
git apply "$PATCH"
echo "Dockerfile patch applied successfully"
else
- echo "Patch does not apply cleanly — upstream Dockerfile likely already includes the changes, proceeding as-is"
+ echo "Patch does not apply cleanly — proceeding as-is"
fi
volumeMounts:
- name: workspace
@@ -139,7 +103,7 @@ spec:
- -c
- |
set -eu
- export PATH="/tools:$PATH"
+ apk add --no-cache podman cosign >/dev/null
if [ -f /workspace/skip ]; then
echo "Nothing to build — tag already exists in registry"
@@ -154,20 +118,19 @@ spec:
echo "==> Building ${IMAGE}:${VERSION}"
- buildctl \
- --addr tcp://buildkitd.image-builder.svc.cluster.local:1234 \
- build \
- --frontend dockerfile.v0 \
- --opt platform=linux/amd64,linux/arm64 \
- --local context=/workspace/bookwyrm \
- --local dockerfile=/workspace/bookwyrm \
- --output "type=image,name=${IMAGE}:${VERSION},push=true,oci-mediatypes=true" \
- --metadata-file /tmp/build-meta.json
+ podman build \
+ --platform linux/amd64,linux/arm64 \
+ --manifest "${IMAGE}:${VERSION}" \
+ -f /workspace/bookwyrm/Dockerfile \
+ /workspace/bookwyrm
- DIGEST="$(crane digest ${IMAGE}:${VERSION})"
- echo "==> Digest: ${DIGEST}"
+ podman manifest push --all "${IMAGE}:${VERSION}" "docker://${IMAGE}:${VERSION}"
+ podman tag "${IMAGE}:${VERSION}" "${IMAGE}:latest"
+ podman push "${IMAGE}:latest"
- crane cp "${IMAGE}:${VERSION}" "${IMAGE}:latest"
+ DIGEST="$(podman inspect --format='{{.RepoDigests}}' ${IMAGE}:${VERSION} | grep -o 'sha256:[^@]*' | cut -d: -f2)"
+ [ -z "$DIGEST" ] && echo "Failed to get digest" && exit 1
+ echo "==> Digest: sha256:${DIGEST}"
COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
cosign sign --yes \
@@ -175,7 +138,7 @@ spec:
--new-bundle-format=false \
--use-signing-config=false \
--registry-referrers-mode=oci-1-1 \
- "${IMAGE}@${DIGEST}"
+ "${IMAGE}@sha256:${DIGEST}"
echo "==> Done: ${IMAGE}:${VERSION}"
env:
@@ -184,8 +147,6 @@ spec:
- name: COSIGN_EXPERIMENTAL
value: "1"
volumeMounts:
- - name: tools
- mountPath: /tools
- name: workspace
mountPath: /workspace
readOnly: true
@@ -197,8 +158,6 @@ spec:
readOnly: true
volumes:
- - name: tools
- emptyDir: {}
- name: workspace
emptyDir: {}
- name: registry-secret
diff --git a/apps/talos_cluster/image-builder/build-matrix-backup-cronjob.yaml b/apps/talos_cluster/image-builder/build-matrix-backup-cronjob.yaml
@@ -16,38 +16,6 @@ spec:
serviceAccountName: image-builder-cronjob
restartPolicy: Never
initContainers:
- - name: setup-buildctl
- image: moby/buildkit:v0.29.0
- command: [cp, /usr/bin/buildctl, /tools/buildctl]
- volumeMounts:
- - name: tools
- mountPath: /tools
-
- - name: setup-cosign
- image: alpine:3
- command:
- - /bin/sh
- - -c
- - |
- wget -qO /tools/cosign https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-amd64 \
- && chmod +x /tools/cosign
- volumeMounts:
- - name: tools
- mountPath: /tools
-
- - name: setup-crane
- image: alpine:3
- command:
- - /bin/sh
- - -c
- - |
- wget -qO /tmp/crane.tar.gz https://github.com/google/go-containerregistry/releases/download/v0.21.4/go-containerregistry_Linux_x86_64.tar.gz \
- && tar -xzf /tmp/crane.tar.gz -C /tools crane \
- && chmod +x /tools/crane
- volumeMounts:
- - name: tools
- mountPath: /tools
-
- name: clone-repo
image: alpine/git:latest
command:
@@ -68,8 +36,7 @@ spec:
- -c
- |
set -eu
- apk add --no-cache git >/dev/null
- export PATH="/tools:$PATH"
+ apk add --no-cache podman cosign >/dev/null
mkdir -p /root/.docker
cp /registry-secret/dockerconfig.json /root/.docker/config.json
@@ -80,23 +47,21 @@ spec:
echo "==> Building ${IMAGE}:${TAG_TS}"
- buildctl \
- --addr tcp://buildkitd.image-builder.svc.cluster.local:1234 \
- build \
- --frontend dockerfile.v0 \
- --opt platform=linux/amd64,linux/arm64 \
- --local context=/workspace/apps/talos_cluster/matrix-backup/backup-tool \
- --local dockerfile=/workspace/apps/talos_cluster/matrix-backup/backup-tool \
- --output "type=image,name=${IMAGE}:${TAG_TS},push=true,oci-mediatypes=true" \
- --metadata-file /tmp/build-meta.json
+ podman build \
+ --platform linux/amd64,linux/arm64 \
+ --manifest "${IMAGE}:${TAG_TS}" \
+ -f /workspace/apps/talos_cluster/matrix-backup/backup-tool/Dockerfile \
+ /workspace/apps/talos_cluster/matrix-backup/backup-tool
- echo "==> Built ${IMAGE}:${TAG_TS}"
+ podman manifest push --all "${IMAGE}:${TAG_TS}" "docker://${IMAGE}:${TAG_TS}"
+ podman tag "${IMAGE}:${TAG_TS}" "${IMAGE}:main"
+ podman tag "${IMAGE}:${TAG_TS}" "${IMAGE}:${TAG_SHA}"
+ podman push "${IMAGE}:main"
+ podman push "${IMAGE}:${TAG_SHA}"
- DIGEST="$(crane digest ${IMAGE}:${TAG_TS})"
- echo "==> Digest: ${DIGEST}"
-
- crane cp "${IMAGE}:${TAG_TS}" "${IMAGE}:main"
- crane cp "${IMAGE}:${TAG_TS}" "${IMAGE}:${TAG_SHA}"
+ DIGEST="$(podman inspect --format='{{.RepoDigests}}' ${IMAGE}:${TAG_TS} | grep -o 'sha256:[^@]*' | cut -d: -f2)"
+ [ -z "$DIGEST" ] && echo "Failed to get digest" && exit 1
+ echo "==> Digest: sha256:${DIGEST}"
COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \
cosign sign --yes \
@@ -104,7 +69,7 @@ spec:
--new-bundle-format=false \
--use-signing-config=false \
--registry-referrers-mode=oci-1-1 \
- "${IMAGE}@${DIGEST}"
+ "${IMAGE}@sha256:${DIGEST}"
echo "==> Done: ${IMAGE}:${TAG_TS}"
env:
@@ -113,8 +78,6 @@ spec:
- name: COSIGN_EXPERIMENTAL
value: "1"
volumeMounts:
- - name: tools
- mountPath: /tools
- name: workspace
mountPath: /workspace
readOnly: true
@@ -126,8 +89,6 @@ spec:
readOnly: true
volumes:
- - name: tools
- emptyDir: {}
- name: workspace
emptyDir: {}
- name: registry-secret
