3405edf821
The commands can be run concurrently, with the exception of e2e that has to be run after e2e-setup is done. The e2e target does not check whether cert-manager and the addons are installed. The two only scripts that were kept are: - make/e2e.sh (previously called ./devel/run-e2e.sh) - make/cluster.sh (previsouly called ./devel/cluster/create.sh) The reason for the removal of the other scripts is that they didn't have that much logic and could easily ported to Make, improving greatly the execution speed thanks to make's concurrency. make/e2e.sh now behaves "as expected" when using -ginkgo.focus or GINKGO_FOCUS; previously, the logs would not be shown before the end of the test. make/cluster.sh has lost the ability to create an OpenShift 3.11 cluster. for running the end-to-end tests. The two reasons are that OpenShift 4 wasn't supported by the script devel/cluster/create.sh, and OpenShift 3.11 is not supported by cert-manager anymore. The Makefile targets that were used in the Prow jobs (verify, verify_deps, verify_chart, verify_upgrade, and cluster) have been kept around. They now show a warning to encourage people to use the new Make-based targets. When running one of the deprecated targets the Makefile won't check the presence of the system tools such as Go and jq, since Bazel takes care of these dependencies. On version change, downloaded tools and images are re-downloaded. The command 'make clean' now keeps the downloaded images and tools. Note that a lot of attention has been put into having a Make system that works flawlessly both on Linux and on BSDs (such as macOS). You will note that some recursive calls to make are made, and $(MAKE) instead of plain "make" is used in that case. If we didn't use $(MAKE), we would have concurrency issues, and warnings such as: make[1]: warning: jobserver unavailable: using -j1. Add `+' to parent make rule. Signed-off-by: Maël Valais <mael@vls.dev>
92 lines
5.8 KiB
Makefile
92 lines
5.8 KiB
Makefile
## Set this as an environment variable to enable signing commands using cmrel.
|
|
## Format should be:
|
|
## projects/<project>/locations/<location>/keyRings/<keyring>/cryptoKeys/<keyname>/cryptoKeyVersions/<keyversion>
|
|
##
|
|
## @category Release
|
|
CMREL_KEY ?=
|
|
|
|
.PHONY: release
|
|
# Build all release artifacts which might be run or used locally, except
|
|
# for anything signed.
|
|
release-artifacts: server-binaries cmctl kubectl-cert_manager helm-chart static-manifests all-containers
|
|
|
|
.PHONY: release-signed
|
|
# Same as `release`, except it also signs the Helm chart. Requires CMREL_KEY
|
|
# to be configured.
|
|
release-artifacts-signed: release-artifacts helm-chart-signature
|
|
|
|
.PHONY: staged-release
|
|
## Create a full release ready to be staged, including containers bundled for
|
|
## distribution. Requires CMREL_KEY to be configured.
|
|
##
|
|
## @category Release
|
|
release: release-signed release-manifests release-containers
|
|
$(MAKE) --no-print-directory bin/release/metadata.json
|
|
|
|
# Set this as an environment variable to enable signing commands using cosign
|
|
# Format should be any accepted by cosign; for GCP, use:
|
|
# gcpkms://projects/<project>/locations/<location>/keyRings/<keyring>/cryptoKeys/<keyname>/versions/<keyversion>
|
|
# CMREL_KEY ?= ""
|
|
# Example of how we can generate a SHA256SUMS file and sign it using cosign
|
|
#bin/SHA256SUMS: $(wildcard ...)
|
|
# @# The patsubst means "all dependencies, but with "bin/" trimmed off the beginning
|
|
# @# We cd into bin so that SHA256SUMS file doesn't have a prefix of `bin` on everything
|
|
# cd $(dir $@) && sha256sum $(patsubst bin/%,%,$^) > $(notdir $@)
|
|
#
|
|
#bin/SHA256SUMS.sig: bin/SHA256SUMS bin/tools/cosign
|
|
# $(COSIGN) sign-blob --key $(COSIGN_KEY) $< > $@
|
|
|
|
# Takes all metadata files in bin/metadata and combines them into one.
|
|
|
|
bin/release/metadata.json: $(wildcard bin/metadata/*.json) | bin/release
|
|
jq -n \
|
|
--arg releaseVersion "$(RELEASE_VERSION)" \
|
|
--arg gitCommitRef "$(GITCOMMIT)" \
|
|
'.releaseVersion = $$releaseVersion | .gitCommitRef = $$gitCommitRef | .artifacts += [inputs]' $^ > $@
|
|
|
|
.PHONY: release-containers
|
|
release-containers: release-container-bundles release-container-metadata
|
|
|
|
.PHONY: release-container-bundles
|
|
release-container-bundles: bin/release/cert-manager-server-linux-amd64.tar.gz bin/release/cert-manager-server-linux-arm64.tar.gz bin/release/cert-manager-server-linux-s390x.tar.gz bin/release/cert-manager-server-linux-ppc64le.tar.gz bin/release/cert-manager-server-linux-arm.tar.gz
|
|
|
|
bin/release/cert-manager-server-linux-amd64.tar.gz bin/release/cert-manager-server-linux-arm64.tar.gz bin/release/cert-manager-server-linux-s390x.tar.gz bin/release/cert-manager-server-linux-ppc64le.tar.gz bin/release/cert-manager-server-linux-arm.tar.gz: bin/release/cert-manager-server-linux-%.tar.gz: bin/containers/cert-manager-acmesolver-linux-%.tar.gz bin/containers/cert-manager-cainjector-linux-%.tar.gz bin/containers/cert-manager-controller-linux-%.tar.gz bin/containers/cert-manager-webhook-linux-%.tar.gz bin/containers/cert-manager-ctl-linux-%.tar.gz bin/scratch/cert-manager.license | bin/release bin/scratch
|
|
@# use basename twice to strip both "tar" and "gz"
|
|
@$(eval CTR_BASENAME := $(basename $(basename $(notdir $@))))
|
|
@$(eval CTR_SCRATCHDIR := bin/scratch/release-container-bundle/$(CTR_BASENAME))
|
|
mkdir -p $(CTR_SCRATCHDIR)/server/images
|
|
echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/version
|
|
echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/acmesolver.docker_tag
|
|
echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/cainjector.docker_tag
|
|
echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/controller.docker_tag
|
|
echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/webhook.docker_tag
|
|
echo "$(RELEASE_VERSION)" > $(CTR_SCRATCHDIR)/server/images/ctl.docker_tag
|
|
cp bin/scratch/cert-manager.license $(CTR_SCRATCHDIR)/LICENSES
|
|
gunzip -c bin/containers/cert-manager-acmesolver-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/acmesolver.tar
|
|
gunzip -c bin/containers/cert-manager-cainjector-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/cainjector.tar
|
|
gunzip -c bin/containers/cert-manager-controller-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/controller.tar
|
|
gunzip -c bin/containers/cert-manager-webhook-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/webhook.tar
|
|
gunzip -c bin/containers/cert-manager-ctl-linux-$*.tar.gz >$(CTR_SCRATCHDIR)/server/images/ctl.tar
|
|
chmod -R 755 $(CTR_SCRATCHDIR)/server/images/*
|
|
tar czf $@ -C bin/scratch/release-container-bundle $(CTR_BASENAME)
|
|
rm -rf $(CTR_SCRATCHDIR)
|
|
|
|
.PHONY: release-container-metadata
|
|
release-container-metadata: bin/metadata/cert-manager-server-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-arm.tar.gz.metadata.json
|
|
|
|
bin/metadata/cert-manager-server-linux-amd64.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-arm64.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-s390x.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-ppc64le.tar.gz.metadata.json bin/metadata/cert-manager-server-linux-arm.tar.gz.metadata.json: bin/metadata/cert-manager-server-linux-%.tar.gz.metadata.json: bin/release/cert-manager-server-linux-%.tar.gz hack/artifact-metadata.template.json | bin/metadata
|
|
jq --arg name "$(notdir $<)" \
|
|
--arg sha256 "$(shell ./hack/util/hash.sh $<)" \
|
|
--arg os "linux" \
|
|
--arg architecture "$*" \
|
|
'.name = $$name | .sha256 = $$sha256 | .os = $$os | .architecture = $$architecture' \
|
|
hack/artifact-metadata.template.json > $@
|
|
|
|
# This target allows us to set all the modified times for all files in bin to the same time, which
|
|
# is similar to what bazel does. We might not want this, and it's not currently used.
|
|
.PHONY: forcetime
|
|
forcetime: | bin
|
|
find bin | xargs touch -d "2000-01-01 00:00:00" -
|
|
|
|
bin/release bin/metadata:
|
|
@mkdir -p $@
|