commit c5e544e36bb7b5cf884d965a3ba223efd8f2be44 parent 2c0c43cebe5a5f9cc86843c244da2651ac3b46d6 Author: MTRNord <MTRNord@users.noreply.github.com> Date: Sat, 11 Apr 2026 15:15:12 +0200 cleanup Signed-off-by: MTRNord <MTRNord@users.noreply.github.com> Diffstat:
| D | apps/talos_cluster/image-builder/build-blog-cronjob.yaml | | | 177 | ------------------------------------------------------------------------------- |
| D | apps/talos_cluster/image-builder/build-bookwyrm-cronjob.yaml | | | 240 | ------------------------------------------------------------------------------- |
| D | apps/talos_cluster/image-builder/build-continuwuity-cronjob.yaml | | | 195 | ------------------------------------------------------------------------------- |
| D | apps/talos_cluster/image-builder/build-matrix-backup-cronjob.yaml | | | 179 | ------------------------------------------------------------------------------- |
| M | apps/talos_cluster/image-builder/kustomization.yaml | | | 7 | ++----- |
5 files changed, 2 insertions(+), 796 deletions(-)
diff --git a/apps/talos_cluster/image-builder/build-blog-cronjob.yaml b/apps/talos_cluster/image-builder/build-blog-cronjob.yaml @@ -1,177 +0,0 @@ -apiVersion: batch/v1 -kind: CronJob -metadata: - name: build-blog - namespace: image-builder -spec: - schedule: "0 3 * * *" - concurrencyPolicy: Forbid - successfulJobsHistoryLimit: 3 - failedJobsHistoryLimit: 3 - jobTemplate: - spec: - ttlSecondsAfterFinished: 86400 - template: - spec: - serviceAccountName: image-builder-cronjob - restartPolicy: Never - initContainers: - - name: register-qemu - image: multiarch/qemu-user-static:latest - securityContext: - privileged: true - command: - - /register - - --reset - - -p - - "yes" - - - name: clone-repo - image: alpine/git:latest - command: - - git - - clone - - --depth=1 - - https://github.com/MTRNord/cluster.git - - /workspace - volumeMounts: - - name: workspace - mountPath: /workspace - - containers: - - name: build - image: alpine:3 - securityContext: - privileged: true - command: - - /bin/sh - - -c - - | - set -eu - apk add --no-cache podman git iptables jq >/dev/null - - # Install cosign v3.0.6 - wget -q https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-amd64 -O /tmp/cosign && chmod +x /tmp/cosign - - mkdir -p /etc/containers - cat > /etc/containers/storage.conf << 'STORAGE_EOF' - [storage] - driver = "vfs" - STORAGE_EOF - - mkdir -p /root/.docker - cp /registry-secret/dockerconfig.json /root/.docker/config.json - - TAG_TS="$(date -u +%Y%m%d-%H%M%S)" - TAG_SHA="sha-$(git -C /workspace rev-parse --short HEAD)" - IMAGE="registry.midnightthoughts.space/mtrnord/blog" - - echo "==> Building ${IMAGE}:${TAG_TS}" - - podman build \ - --platform linux/amd64,linux/arm64 \ - --manifest "${IMAGE}:${TAG_TS}" \ - -f /workspace/apps/talos_cluster/blog/docker/Dockerfile \ - /workspace/apps/talos_cluster/blog/docker - - podman manifest push --all "${IMAGE}:${TAG_TS}" "docker://${IMAGE}:${TAG_TS}" - podman pull "${IMAGE}:${TAG_TS}" - podman tag "${IMAGE}:${TAG_TS}" "${IMAGE}:latest" - podman tag "${IMAGE}:${TAG_TS}" "${IMAGE}:${TAG_SHA}" - podman push "${IMAGE}:latest" - podman push "${IMAGE}:${TAG_SHA}" - - # Pull again to refresh digest from registry - podman rmi "${IMAGE}:${TAG_TS}" "${IMAGE}:latest" "${IMAGE}:${TAG_SHA}" || true - sleep 2 - podman pull "${IMAGE}:${TAG_TS}" - podman pull "${IMAGE}:latest" - podman pull "${IMAGE}:${TAG_SHA}" - - # Collect all unique digests from all tags - DIGESTS_TO_SIGN="" - for attempt in 1 2 3 4 5; do - TAG_TS_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_TS}" 2>/dev/null | cut -d@ -f2)" - TAG_LATEST_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:latest" 2>/dev/null | cut -d@ -f2)" - TAG_SHA_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_SHA}" 2>/dev/null | cut -d@ -f2)" - - if [ -n "$TAG_TS_DIGEST" ]; then - DIGESTS_TO_SIGN=$(echo "$DIGESTS_TO_SIGN $TAG_TS_DIGEST" | tr ' ' '\n' | sort -u | tr '\n' ' ') - fi - if [ -n "$TAG_LATEST_DIGEST" ]; then - DIGESTS_TO_SIGN=$(echo "$DIGESTS_TO_SIGN $TAG_LATEST_DIGEST" | tr ' ' '\n' | sort -u | tr '\n' ' ') - fi - if [ -n "$TAG_SHA_DIGEST" ]; then - DIGESTS_TO_SIGN=$(echo "$DIGESTS_TO_SIGN $TAG_SHA_DIGEST" | tr ' ' '\n' | sort -u | tr '\n' ' ') - fi - - if [ -n "$DIGESTS_TO_SIGN" ]; then - break - fi - if [ $attempt -lt 5 ]; then - echo "Waiting for registry to index tags (attempt $attempt/5)..." - sleep 3 - fi - done - - [ -z "$DIGESTS_TO_SIGN" ] && echo "Failed to get tag digests after retries" && exit 1 - echo "==> Unique digests to sign: $DIGESTS_TO_SIGN" - - # Wait a bit more to ensure registry has the digests available for signing - sleep 2 - - # Sign all tag digests (manifest list and/or platform-specific) - for DIGEST in $DIGESTS_TO_SIGN; do - echo "==> Signing tag digest: ${DIGEST}" - COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \ - /tmp/cosign sign --yes \ - --key /cosign-secret/cosign.key \ - --new-bundle-format=false \ - --use-signing-config=false \ - --registry-referrers-mode=oci-1-1 \ - "${IMAGE}@${DIGEST}" || true - done - - # Sign each platform digest from the manifest - podman manifest inspect "${IMAGE}:${TAG_TS}" 2>/dev/null | jq -r '.manifests[].digest' 2>/dev/null | while read -r DIGEST; do - [ -z "$DIGEST" ] && continue - # Skip if already signed (check if it's in our tag digests) - if echo "$DIGESTS_TO_SIGN" | grep -q "$DIGEST"; then - continue - fi - echo "==> Signing platform digest: ${DIGEST}" - COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \ - /tmp/cosign sign --yes \ - --key /cosign-secret/cosign.key \ - --new-bundle-format=false \ - --use-signing-config=false \ - --registry-referrers-mode=oci-1-1 \ - "${IMAGE}@${DIGEST}" || true - done - - echo "==> Done: ${IMAGE}:${TAG_TS}" - env: - - name: COSIGN_OCI_EXPERIMENTAL - value: "1" - - name: COSIGN_EXPERIMENTAL - value: "1" - volumeMounts: - - name: workspace - mountPath: /workspace - readOnly: true - - name: registry-secret - mountPath: /registry-secret - readOnly: true - - name: cosign-secret - mountPath: /cosign-secret - readOnly: true - - volumes: - - name: workspace - emptyDir: {} - - name: registry-secret - secret: - secretName: image-builder-registry-secret - - name: cosign-secret - secret: - secretName: image-builder-cosign-secret diff --git a/apps/talos_cluster/image-builder/build-bookwyrm-cronjob.yaml b/apps/talos_cluster/image-builder/build-bookwyrm-cronjob.yaml @@ -1,240 +0,0 @@ -apiVersion: batch/v1 -kind: CronJob -metadata: - name: build-bookwyrm - namespace: image-builder -spec: - schedule: "0 4 * * *" - concurrencyPolicy: Forbid - successfulJobsHistoryLimit: 3 - failedJobsHistoryLimit: 3 - jobTemplate: - spec: - ttlSecondsAfterFinished: 86400 - template: - spec: - serviceAccountName: image-builder-cronjob - restartPolicy: OnFailure - initContainers: - - name: register-qemu - image: multiarch/qemu-user-static:latest - securityContext: - privileged: true - command: - - /register - - --reset - - -p - - "yes" - - - name: check-version - image: alpine:3 - command: - - /bin/sh - - -c - - | - set -eu - apk add --no-cache curl >/dev/null 2>&1 - - NEW=$(curl -sf "https://api.github.com/repos/bookwyrm-social/bookwyrm/releases/latest" \ - | grep '"tag_name"' | head -1 | cut -d'"' -f4) - - if [ -z "$NEW" ]; then - echo "ERROR: could not determine upstream version" >&2 - exit 1 - fi - - echo "Upstream version: ${NEW}" - echo "${NEW}" > /workspace/version - - TAGS=$(curl -sf "https://registry.midnightthoughts.space/v2/mtrnord/bookwyrm/tags/list" \ - | grep -o '"tags":\[[^]]*\]' || echo "") - if echo "$TAGS" | grep -q "\"${NEW}\""; then - echo "Tag ${NEW} already exists in registry — skipping build" - touch /workspace/skip - else - echo "Tag ${NEW} not found in registry — will build" - fi - volumeMounts: - - name: workspace - mountPath: /workspace - - - name: clone-gitops - image: alpine/git:latest - command: - - git - - clone - - --depth=1 - - https://github.com/MTRNord/cluster.git - - /workspace/gitops - volumeMounts: - - name: workspace - mountPath: /workspace - - - name: clone-bookwyrm - image: alpine/git:latest - command: - - /bin/sh - - -c - - | - set -eu - if [ -f /workspace/skip ]; then - echo "Skipping bookwyrm clone (tag already in registry)" - exit 0 - fi - - VERSION="$(cat /workspace/version)" - echo "Cloning bookwyrm ${VERSION}" - - git clone --depth=1 --branch "${VERSION}" \ - https://github.com/bookwyrm-social/bookwyrm.git \ - /workspace/bookwyrm - - cd /workspace/bookwyrm - - PATCH="/workspace/gitops/apps/talos_cluster/bookwyrm/dockerfile.patch" - if git apply --check "$PATCH" 2>/dev/null; then - git apply "$PATCH" - echo "Dockerfile patch applied successfully" - else - echo "Patch does not apply cleanly — proceeding as-is" - fi - volumeMounts: - - name: workspace - mountPath: /workspace - - containers: - - name: build - image: alpine:3 - securityContext: - privileged: true - command: - - /bin/sh - - -c - - | - set -eu - apk add --no-cache podman git iptables jq >/dev/null - - # Set up QEMU permissions for the root user - - # Install cosign v3.0.6 - wget -q https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-amd64 -O /tmp/cosign && chmod +x /tmp/cosign - - mkdir -p /etc/containers - cat > /etc/containers/storage.conf << 'STORAGE_EOF' - [storage] - driver = "vfs" - STORAGE_EOF - - if [ -f /workspace/skip ]; then - echo "Nothing to build — tag already exists in registry" - exit 0 - fi - - VERSION="$(cat /workspace/version)" - IMAGE="registry.midnightthoughts.space/mtrnord/bookwyrm" - - mkdir -p /root/.docker - cp /registry-secret/dockerconfig.json /root/.docker/config.json - - echo "==> Building ${IMAGE}:${VERSION}" - - podman build \ - --platform linux/amd64,linux/arm64 \ - --manifest "${IMAGE}:${VERSION}" \ - -f /workspace/bookwyrm/Dockerfile \ - /workspace/bookwyrm - - podman manifest push --all "${IMAGE}:${VERSION}" "docker://${IMAGE}:${VERSION}" - podman pull "${IMAGE}:${VERSION}" - podman tag "${IMAGE}:${VERSION}" "${IMAGE}:latest" - podman push "${IMAGE}:latest" - - # Pull all tags to refresh digests from registry - podman rmi "${IMAGE}:${VERSION}" "${IMAGE}:latest" || true - sleep 2 - podman pull "${IMAGE}:${VERSION}" - podman pull "${IMAGE}:latest" - - # Collect all unique digests from all tags - DIGESTS_TO_SIGN="" - for attempt in 1 2 3 4 5; do - TAG_VERSION_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${VERSION}" 2>/dev/null | cut -d@ -f2)" - TAG_LATEST_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:latest" 2>/dev/null | cut -d@ -f2)" - - if [ -n "$TAG_VERSION_DIGEST" ]; then - DIGESTS_TO_SIGN=$(echo "$DIGESTS_TO_SIGN $TAG_VERSION_DIGEST" | tr ' ' '\n' | sort -u | tr '\n' ' ') - fi - if [ -n "$TAG_LATEST_DIGEST" ]; then - DIGESTS_TO_SIGN=$(echo "$DIGESTS_TO_SIGN $TAG_LATEST_DIGEST" | tr ' ' '\n' | sort -u | tr '\n' ' ') - fi - - if [ -n "$DIGESTS_TO_SIGN" ]; then - break - fi - if [ $attempt -lt 5 ]; then - echo "Waiting for registry to index tags (attempt $attempt/5)..." - sleep 3 - fi - done - - [ -z "$DIGESTS_TO_SIGN" ] && echo "Failed to get tag digests after retries" && exit 1 - echo "==> Unique digests to sign: $DIGESTS_TO_SIGN" - - # Wait a bit more to ensure registry has the digests available for signing - sleep 2 - - # Sign all tag digests (manifest list and/or platform-specific) - for DIGEST in $DIGESTS_TO_SIGN; do - echo "==> Signing tag digest: ${DIGEST}" - COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \ - /tmp/cosign sign --yes \ - --key /cosign-secret/cosign.key \ - --new-bundle-format=false \ - --use-signing-config=false \ - --registry-referrers-mode=oci-1-1 \ - "${IMAGE}@${DIGEST}" || true - done - - # Sign each platform digest from the manifest - podman manifest inspect "${IMAGE}:${VERSION}" 2>/dev/null | jq -r '.manifests[].digest' 2>/dev/null | while read -r DIGEST; do - [ -z "$DIGEST" ] && continue - # Skip if already signed (check if it's in our tag digests) - if echo "$DIGESTS_TO_SIGN" | grep -q "$DIGEST"; then - continue - fi - echo "==> Signing platform digest: ${DIGEST}" - COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \ - /tmp/cosign sign --yes \ - --key /cosign-secret/cosign.key \ - --new-bundle-format=false \ - --use-signing-config=false \ - --registry-referrers-mode=oci-1-1 \ - "${IMAGE}@${DIGEST}" || true - done - - echo "==> Done: ${IMAGE}:${VERSION}" - env: - - name: COSIGN_OCI_EXPERIMENTAL - value: "1" - - name: COSIGN_EXPERIMENTAL - value: "1" - volumeMounts: - - name: workspace - mountPath: /workspace - readOnly: true - - name: registry-secret - mountPath: /registry-secret - readOnly: true - - name: cosign-secret - mountPath: /cosign-secret - readOnly: true - - volumes: - - name: workspace - emptyDir: {} - - name: registry-secret - secret: - secretName: image-builder-registry-secret - - name: cosign-secret - secret: - secretName: image-builder-cosign-secret diff --git a/apps/talos_cluster/image-builder/build-continuwuity-cronjob.yaml b/apps/talos_cluster/image-builder/build-continuwuity-cronjob.yaml @@ -1,195 +0,0 @@ -apiVersion: batch/v1 -kind: CronJob -metadata: - name: build-continuwuity - namespace: image-builder -spec: - schedule: "0 5 * * *" - concurrencyPolicy: Forbid - successfulJobsHistoryLimit: 3 - failedJobsHistoryLimit: 3 - jobTemplate: - spec: - ttlSecondsAfterFinished: 86400 - template: - spec: - serviceAccountName: image-builder-cronjob - restartPolicy: Never - initContainers: - - name: register-qemu - image: multiarch/qemu-user-static:latest - securityContext: - privileged: true - command: - - /register - - --reset - - -p - - "yes" - - - name: clone-repo - image: alpine/git:latest - command: - - git - - clone - - --depth=1 - - https://github.com/MTRNord/cluster.git - - /workspace - volumeMounts: - - name: workspace - mountPath: /workspace - - - name: setup-cosign - image: alpine:3 - command: - - /bin/sh - - -c - - | - wget -qO /tools/cosign https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-amd64 \ - && chmod +x /tools/cosign - volumeMounts: - - name: tools - mountPath: /tools - - containers: - - name: build - image: alpine:3 - securityContext: - privileged: true - command: - - /bin/sh - - -c - - | - set -eu - apk add --no-cache podman git iptables jq >/dev/null - - # Set up QEMU permissions for the root user - - # Install cosign v3.0.6 - wget -q https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-amd64 -O /tmp/cosign && chmod +x /tmp/cosign - - mkdir -p /etc/containers - cat > /etc/containers/storage.conf << 'STORAGE_EOF' - [storage] - driver = "vfs" - STORAGE_EOF - - mkdir -p /root/.docker - cp /registry-secret/dockerconfig.json /root/.docker/config.json - - TAG_TS="$(date -u +%Y%m%d-%H%M%S)" - TAG_SHA="sha-$(git -C /workspace rev-parse --short HEAD)" - IMAGE="registry.midnightthoughts.space/mtrnord/cluster/continuwuity" - - echo "==> Building ${IMAGE}:${TAG_TS}" - - podman build \ - --platform linux/amd64,linux/arm64 \ - --manifest "${IMAGE}:${TAG_TS}" \ - -f /workspace/apps/talos_cluster/continuwuity/Dockerfile \ - /workspace/apps/talos_cluster/continuwuity - - podman manifest push --all "${IMAGE}:${TAG_TS}" "docker://${IMAGE}:${TAG_TS}" - podman pull "${IMAGE}:${TAG_TS}" - podman tag "${IMAGE}:${TAG_TS}" "${IMAGE}:main" - podman tag "${IMAGE}:${TAG_TS}" "${IMAGE}:${TAG_SHA}" - podman push "${IMAGE}:main" - podman push "${IMAGE}:${TAG_SHA}" - - # Pull again to refresh digest from registry - podman rmi "${IMAGE}:${TAG_TS}" "${IMAGE}:main" "${IMAGE}:${TAG_SHA}" || true - sleep 2 - podman pull "${IMAGE}:${TAG_TS}" - podman pull "${IMAGE}:main" - podman pull "${IMAGE}:${TAG_SHA}" - - # Collect all unique digests from all tags - DIGESTS_TO_SIGN="" - for attempt in 1 2 3 4 5; do - TAG_TS_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_TS}" 2>/dev/null | cut -d@ -f2)" - TAG_MAIN_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:main" 2>/dev/null | cut -d@ -f2)" - TAG_SHA_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_SHA}" 2>/dev/null | cut -d@ -f2)" - - if [ -n "$TAG_TS_DIGEST" ]; then - DIGESTS_TO_SIGN=$(echo "$DIGESTS_TO_SIGN $TAG_TS_DIGEST" | tr ' ' '\n' | sort -u | tr '\n' ' ') - fi - if [ -n "$TAG_MAIN_DIGEST" ]; then - DIGESTS_TO_SIGN=$(echo "$DIGESTS_TO_SIGN $TAG_MAIN_DIGEST" | tr ' ' '\n' | sort -u | tr '\n' ' ') - fi - if [ -n "$TAG_SHA_DIGEST" ]; then - DIGESTS_TO_SIGN=$(echo "$DIGESTS_TO_SIGN $TAG_SHA_DIGEST" | tr ' ' '\n' | sort -u | tr '\n' ' ') - fi - - if [ -n "$DIGESTS_TO_SIGN" ]; then - break - fi - if [ $attempt -lt 5 ]; then - echo "Waiting for registry to index tags (attempt $attempt/5)..." - sleep 3 - fi - done - - [ -z "$DIGESTS_TO_SIGN" ] && echo "Failed to get tag digests after retries" && exit 1 - echo "==> Unique digests to sign: $DIGESTS_TO_SIGN" - - # Wait a bit more to ensure registry has the digests available for signing - sleep 2 - - # Sign all tag digests (manifest list and/or platform-specific) - for DIGEST in $DIGESTS_TO_SIGN; do - echo "==> Signing tag digest: ${DIGEST}" - COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \ - /tmp/cosign sign --yes \ - --key /cosign-secret/cosign.key \ - --new-bundle-format=false \ - --use-signing-config=false \ - --registry-referrers-mode=oci-1-1 \ - "${IMAGE}@${DIGEST}" || true - done - - # Sign each platform digest from the manifest - podman manifest inspect "${IMAGE}:${TAG_TS}" 2>/dev/null | jq -r '.manifests[].digest' 2>/dev/null | while read -r DIGEST; do - [ -z "$DIGEST" ] && continue - # Skip if already signed (check if it's in our tag digests) - if echo "$DIGESTS_TO_SIGN" | grep -q "$DIGEST"; then - continue - fi - echo "==> Signing platform digest: ${DIGEST}" - COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \ - /tmp/cosign sign --yes \ - --key /cosign-secret/cosign.key \ - --new-bundle-format=false \ - --use-signing-config=false \ - --registry-referrers-mode=oci-1-1 \ - "${IMAGE}@${DIGEST}" || true - done - - echo "==> Done: ${IMAGE}:${TAG_TS}" - env: - - name: COSIGN_OCI_EXPERIMENTAL - value: "1" - - name: COSIGN_EXPERIMENTAL - value: "1" - volumeMounts: - - name: tools - mountPath: /tools - - name: workspace - mountPath: /workspace - readOnly: true - - name: registry-secret - mountPath: /registry-secret - readOnly: true - - name: cosign-secret - mountPath: /cosign-secret - readOnly: true - - volumes: - - name: tools - emptyDir: {} - - name: workspace - emptyDir: {} - - name: registry-secret - secret: - secretName: image-builder-registry-secret - - name: cosign-secret - secret: - secretName: image-builder-cosign-secret diff --git a/apps/talos_cluster/image-builder/build-matrix-backup-cronjob.yaml b/apps/talos_cluster/image-builder/build-matrix-backup-cronjob.yaml @@ -1,179 +0,0 @@ -apiVersion: batch/v1 -kind: CronJob -metadata: - name: build-matrix-backup - namespace: image-builder -spec: - schedule: "0 4 * * *" - concurrencyPolicy: Forbid - successfulJobsHistoryLimit: 3 - failedJobsHistoryLimit: 3 - jobTemplate: - spec: - ttlSecondsAfterFinished: 86400 - template: - spec: - serviceAccountName: image-builder-cronjob - restartPolicy: Never - initContainers: - - name: register-qemu - image: multiarch/qemu-user-static:latest - securityContext: - privileged: true - command: - - /register - - --reset - - -p - - "yes" - - - name: clone-repo - image: alpine/git:latest - command: - - git - - clone - - --depth=1 - - https://github.com/MTRNord/cluster.git - - /workspace - volumeMounts: - - name: workspace - mountPath: /workspace - - containers: - - name: build - image: alpine:3 - securityContext: - privileged: true - command: - - /bin/sh - - -c - - | - set -eu - apk add --no-cache podman git iptables jq >/dev/null - - # Set up QEMU permissions for the root user - - # Install cosign v3.0.6 - wget -q https://github.com/sigstore/cosign/releases/download/v3.0.6/cosign-linux-amd64 -O /tmp/cosign && chmod +x /tmp/cosign - - mkdir -p /etc/containers - cat > /etc/containers/storage.conf << 'STORAGE_EOF' - [storage] - driver = "vfs" - STORAGE_EOF - - mkdir -p /root/.docker - cp /registry-secret/dockerconfig.json /root/.docker/config.json - - TAG_TS="$(date -u +%Y%m%d-%H%M%S)" - TAG_SHA="sha-$(git -C /workspace rev-parse --short HEAD)" - IMAGE="registry.midnightthoughts.space/mtrnord/cluster/matrix-backup" - - echo "==> Building ${IMAGE}:${TAG_TS}" - - podman build \ - --platform linux/amd64,linux/arm64 \ - --manifest "${IMAGE}:${TAG_TS}" \ - -f /workspace/apps/talos_cluster/matrix-backup/backup-tool/Dockerfile \ - /workspace/apps/talos_cluster/matrix-backup/backup-tool - - podman manifest push --all "${IMAGE}:${TAG_TS}" "docker://${IMAGE}:${TAG_TS}" - podman pull "${IMAGE}:${TAG_TS}" - podman tag "${IMAGE}:${TAG_TS}" "${IMAGE}:main" - podman tag "${IMAGE}:${TAG_TS}" "${IMAGE}:${TAG_SHA}" - podman push "${IMAGE}:main" - podman push "${IMAGE}:${TAG_SHA}" - - # Pull all tags to refresh digests from registry - podman rmi "${IMAGE}:${TAG_TS}" "${IMAGE}:main" "${IMAGE}:${TAG_SHA}" || true - sleep 2 - podman pull "${IMAGE}:${TAG_TS}" - podman pull "${IMAGE}:main" - podman pull "${IMAGE}:${TAG_SHA}" - - # Collect all unique digests from all tags - DIGESTS_TO_SIGN="" - for attempt in 1 2 3 4 5; do - TAG_TS_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_TS}" 2>/dev/null | cut -d@ -f2)" - TAG_MAIN_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:main" 2>/dev/null | cut -d@ -f2)" - TAG_SHA_DIGEST="$(podman image inspect --format='{{index .RepoDigests 0}}' "${IMAGE}:${TAG_SHA}" 2>/dev/null | cut -d@ -f2)" - - if [ -n "$TAG_TS_DIGEST" ]; then - DIGESTS_TO_SIGN=$(echo "$DIGESTS_TO_SIGN $TAG_TS_DIGEST" | tr ' ' '\n' | sort -u | tr '\n' ' ') - fi - if [ -n "$TAG_MAIN_DIGEST" ]; then - DIGESTS_TO_SIGN=$(echo "$DIGESTS_TO_SIGN $TAG_MAIN_DIGEST" | tr ' ' '\n' | sort -u | tr '\n' ' ') - fi - if [ -n "$TAG_SHA_DIGEST" ]; then - DIGESTS_TO_SIGN=$(echo "$DIGESTS_TO_SIGN $TAG_SHA_DIGEST" | tr ' ' '\n' | sort -u | tr '\n' ' ') - fi - - if [ -n "$DIGESTS_TO_SIGN" ]; then - break - fi - if [ $attempt -lt 5 ]; then - echo "Waiting for registry to index tags (attempt $attempt/5)..." - sleep 3 - fi - done - - [ -z "$DIGESTS_TO_SIGN" ] && echo "Failed to get tag digests after retries" && exit 1 - echo "==> Unique digests to sign: $DIGESTS_TO_SIGN" - - # Wait a bit more to ensure registry has the digests available for signing - sleep 2 - - # Sign all tag digests (manifest list and/or platform-specific) - for DIGEST in $DIGESTS_TO_SIGN; do - echo "==> Signing tag digest: ${DIGEST}" - COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \ - /tmp/cosign sign --yes \ - --key /cosign-secret/cosign.key \ - --new-bundle-format=false \ - --use-signing-config=false \ - --registry-referrers-mode=oci-1-1 \ - "${IMAGE}@${DIGEST}" || true - done - - # Sign each platform digest from the manifest - podman manifest inspect "${IMAGE}:${TAG_TS}" 2>/dev/null | jq -r '.manifests[].digest' 2>/dev/null | while read -r DIGEST; do - [ -z "$DIGEST" ] && continue - # Skip if already signed (check if it's in our tag digests) - if echo "$DIGESTS_TO_SIGN" | grep -q "$DIGEST"; then - continue - fi - echo "==> Signing platform digest: ${DIGEST}" - COSIGN_PASSWORD="$(cat /cosign-secret/cosign.password)" \ - /tmp/cosign sign --yes \ - --key /cosign-secret/cosign.key \ - --new-bundle-format=false \ - --use-signing-config=false \ - --registry-referrers-mode=oci-1-1 \ - "${IMAGE}@${DIGEST}" || true - done - - echo "==> Done: ${IMAGE}:${TAG_TS}" - env: - - name: COSIGN_OCI_EXPERIMENTAL - value: "1" - - name: COSIGN_EXPERIMENTAL - value: "1" - volumeMounts: - - name: workspace - mountPath: /workspace - readOnly: true - - name: registry-secret - mountPath: /registry-secret - readOnly: true - - name: cosign-secret - mountPath: /cosign-secret - readOnly: true - - volumes: - - name: workspace - emptyDir: {} - - name: registry-secret - secret: - secretName: image-builder-registry-secret - - name: cosign-secret - secret: - secretName: image-builder-cosign-secret diff --git a/apps/talos_cluster/image-builder/kustomization.yaml b/apps/talos_cluster/image-builder/kustomization.yaml @@ -5,8 +5,4 @@ resources: - rbac.yaml - binfmt-daemonset.yaml - registry-secret.yaml - - cosign-secret.yaml - #- build-blog-cronjob.yaml - #- build-continuwuity-cronjob.yaml - #- build-bookwyrm-cronjob.yaml - - build-matrix-backup-cronjob.yaml + - cosign-secret.yaml +\ No newline at end of file