From e2a931b307ae9b6d8b9f326809c7ca4c42ad3008 Mon Sep 17 00:00:00 2001 From: Paul Abel Date: Wed, 10 Apr 2024 15:58:59 +0100 Subject: [PATCH 1/5] update image patching workflow --- .../certify-openshift-image/action.yml | 57 +++ .github/workflows/patch-image.yml | 84 ++++ .github/workflows/update-docker-images.yml | 428 ++++++++++++------ Makefile | 4 + build/Dockerfile | 42 +- 5 files changed, 458 insertions(+), 157 deletions(-) create mode 100644 .github/actions/certify-openshift-image/action.yml create mode 100644 .github/workflows/patch-image.yml diff --git a/.github/actions/certify-openshift-image/action.yml b/.github/actions/certify-openshift-image/action.yml new file mode 100644 index 0000000000..cf13cd5da1 --- /dev/null +++ b/.github/actions/certify-openshift-image/action.yml @@ -0,0 +1,57 @@ +name: Certify Openshift Image +description: This action with attempt to certify an image for use in Openshift + +inputs: + image: + description: The image manifest to certify in the format /: + required: true + project_id: + description: The certification project id + required: true + pyxis_token: + description: The Pyxis API Token + required: true + preflight_version: + description: The version of the preflight utility to install + required: false + default: 1.9.1 + platforms: + description: A comma separated list of architectures in the image manifest to certify + required: false + default: "" + +outputs: + result: + description: Did the certification succeed? + value: ${{ steps.result.outputs.result == 0 && true || false }} + +runs: + using: composite + steps: + - name: Install openshift-preflight + run: | + curl -fsSL https://github.com/redhat-openshift-ecosystem/openshift-preflight/releases/download/${{ inputs.preflight_version }}/preflight-linux-amd64 --output preflight + chmod +x preflight + shell: bash + + - name: Certify Images + id: result + run: | + result=0 + if [ -z "${{ inputs.platforms }}" ]; then + # list of platforms passed + IFS=',' read -ra arch_list <<< "${{ inputs.platforms }}" + for arch in "${arch_list[@]}"; do + architecture=("${arch#*/}") + ./preflight check container ${{ inputs.image }} --pyxis-api-token ${{ inputs.pyxis_token }} --certification-project-id ${{ inputs.project_id }} --platform $architecture --submit + if [ $? -ne 0 ]; then + result=1 + fi + done + else + # no platforms passed, this is either a manifest or a single platform image + ./preflight check container ${{ inputs.image }} --pyxis-api-token ${{ inputs.pyxis_token }} --certification-project-id ${{ inputs.project_id }} --submit + result=$? + fi + echo "result=$result" >> $GITHUB_OUTPUT + shell: bash diff --git a/.github/workflows/patch-image.yml b/.github/workflows/patch-image.yml new file mode 100644 index 0000000000..44025679d5 --- /dev/null +++ b/.github/workflows/patch-image.yml @@ -0,0 +1,84 @@ +name: Patch Docker Image + +on: + workflow_call: + inputs: + image: + description: The image name to patch + required: true + type: string + target_image: + description: The target name of the patched image + required: true + type: string + tag: + description: The image tag to patch + required: true + type: string + target_tag: + description: The target tag of the patched image + required: true + type: string + ic_version: + description: The IC version to label + required: true + type: string + platforms: + description: The platforms to patch + required: true + type: string + +defaults: + run: + shell: bash + +permissions: + contents: read + +jobs: + patch-image: + name: Patch image + runs-on: ubuntu-22.04 + permissions: + contents: read + id-token: write + steps: + - name: Checkout Repository + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 + + - name: Docker Buildx + uses: docker/setup-buildx-action@2b51285047da1547ffb1b2203d8be4c0af6b1f20 # v3.2.0 + + - name: Setup QEMU + uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0 + with: + platforms: arm,arm64,ppc64le,s390x + + - name: Authenticate to Google Cloud + id: auth + uses: google-github-actions/auth@55bd3a7c6e2ae7cf1877fd1ccb9d54c0503c457c # v2.1.2 + with: + token_format: access_token + workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }} + service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }} + + - name: Login to GCR + uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0 + with: + registry: gcr.io + username: oauth2accesstoken + password: ${{ steps.auth.outputs.access_token }} + + - name: Apply OS patches to Container + uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0 + with: + file: build/Dockerfile + context: "." + target: patched + tags: "${{ inputs.target_image }}:${{ inputs.target_tag }}" + platforms: ${{ inputs.platforms }} + pull: true + push: true + build-args: | + IMAGE_NAME=${{ inputs.image }}:${{ inputs.tag }} + IC_VERSION=${{ inputs.ic_version }} diff --git a/.github/workflows/update-docker-images.yml b/.github/workflows/update-docker-images.yml index 82466dd4ac..c6bc1aae52 100644 --- a/.github/workflows/update-docker-images.yml +++ b/.github/workflows/update-docker-images.yml @@ -2,13 +2,15 @@ name: Update Docker Images on: schedule: - - cron: "0 1 * * *" # run every day at 01:00 UTC + - cron: "0 1 * * 0" # run every week at 01:00 UTC on Sunday workflow_dispatch: inputs: - force: - description: "Force update of all images" - required: false - default: "false" + tag: + description: "Update images with tag" + required: true + dry_run: + type: boolean + default: false defaults: run: @@ -23,174 +25,320 @@ permissions: jobs: variables: - name: Get versions of base images + name: Set variables for workflow runs-on: ubuntu-22.04 outputs: - kic-tag: ${{ steps.kic.outputs.tag }} - versions: ${{ steps.versions.outputs.matrix }} - go-md5: ${{ steps.md5.outputs.go_code_md5 }} - binary-cache-hit: ${{ steps.binary-cache.outputs.cache-hit }} - base-image-md5: ${{ steps.md5.outputs.docker_md5 }} + tag: ${{ steps.kic.outputs.tag }} + short_tag: ${{ steps.kic.outputs.short }} + date: ${{ steps.kic.outputs.date }} steps: - name: Checkout Repository uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 with: fetch-depth: 0 - - name: Set KIC version + - name: Set variables id: kic run: | tag="$(git tag --sort=-version:refname | head -n1)" - echo "tag=${tag//v}" >> $GITHUB_OUTPUT + if [ -n "${{ inputs.tag }}" ]; then + echo "tag=${{ inputs.tag }}" >> $GITHUB_OUTPUT + else + tag=${tag//v} + echo "tag=${tag//v}" >> $GITHUB_OUTPUT + fi + date=$(date "+%Y%m%d") + echo "date=${date}" >> $GITHUB_OUTPUT + short="${tag%.*}" + echo "short=$short" >> $GITHUB_OUTPUT + cat $GITHUB_OUTPUT - - name: Checkout Repository at ${{ steps.kic.outputs.tag }} - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 - with: - ref: refs/tags/v${{ steps.kic.outputs.tag }} - - - name: Set NGINX versions - id: versions - run: | - nginx=library/$(grep -E "FROM nginx.*debian" < build/Dockerfile | awk -F" " '{print $2}' | cut -d '@' -f 1) - nginx_alpine=library/$(grep -E "FROM nginx.*alpine" < build/Dockerfile | awk -F" " '{print $2}' | cut -d '@' -f 1) - nginx_ubi=$(grep -m1 "FROM nginx.*ubi" < build/Dockerfile | awk -F" " '{print $2}' | cut -d '@' -f 1) - echo "matrix=[{\"version\": \"${nginx}\", \"distro\": \"debian\"}, {\"version\": \"${nginx_alpine}\", \"distro\": \"alpine\"}, {\"version\": \"${nginx_ubi}\", \"distro\": \"ubi\"}]" >> $GITHUB_OUTPUT - - - name: Set Go MD5sums - id: md5 - run: | - ./.github/scripts/variables.sh go_code_md5 >> $GITHUB_OUTPUT - ./.github/scripts/variables.sh docker_md5 >> $GITHUB_OUTPUT - - - name: Fetch Cached Binary Artifacts - id: binary-cache - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2 - with: - path: ${{ github.workspace }}/dist - key: nginx-ingress-${{ steps.md5.outputs.go_code_md5 }} - lookup-only: true - - check: - name: Check if updates are needed - runs-on: ubuntu-22.04 - needs: variables - outputs: - needs-updating-debian: ${{ steps.needs.outputs.debian }} - needs-updating-alpine: ${{ steps.needs.outputs.alpine }} - needs-updating-ubi: ${{ steps.needs.outputs.ubi }} + patch-oss-images: + name: Build OSS Images + needs: [variables] strategy: + fail-fast: false matrix: - base_image: ${{ fromJson(needs.variables.outputs.versions) }} - steps: - - name: Build KIC tag - id: dist - run: | - if [ ${{ matrix.base_image.distro }} == "debian" ]; then dist=""; else dist="-${{ matrix.base_image.distro }}"; fi - echo "tag=${{ needs.variables.outputs.kic-tag }}${dist}" >> $GITHUB_OUTPUT - - - name: Check if update available for ${{ matrix.base_image.version }} - id: update - uses: lucacome/docker-image-update-checker@f50d56412b948cfdbb842c5419372681e0db3df1 # v1.2.1 - with: - base-image: ${{ matrix.base_image.version}} - image: nginx/nginx-ingress:${{ steps.dist.outputs.tag }} - env: - DEBUG: ${{ secrets.ACTIONS_STEP_DEBUG }} + include: + - tag: ${{ needs.variables.outputs.tag }} + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" + image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic/nginx-ingress + target_image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic/nginx-ingress" + platforms: "linux/arm, linux/arm64, linux/amd64, linux/ppc64le, linux/s390x" + - tag: ${{ needs.variables.outputs.tag }}-alpine + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-alpine" + image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic/nginx-ingress + target_image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic/nginx-ingress" + platforms: "linux/arm, linux/arm64, linux/amd64, linux/ppc64le, linux/s390x" + - tag: ${{ needs.variables.outputs.tag }}-ubi + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-ubi" + image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic/nginx-ingress + target_image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic/nginx-ingress" + platforms: "linux/arm64, linux/amd64, linux/ppc64le, linux/s390x" + uses: ./.github/workflows/patch-image.yml + with: + platforms: ${{ matrix.platforms }} + image: ${{ matrix.image }} + tag: ${{ matrix.tag }} + ic_version: ${{ needs.variables.outputs.tag }} + target_image: ${{ matrix.target_image }} + target_tag: ${{ matrix.target_tag }} + permissions: + contents: read + id-token: write + secrets: inherit - - id: needs - run: echo "${{ matrix.base_image.distro }}=${{ steps.update.outputs.needs-updating }}" >> $GITHUB_OUTPUT + patch-plus-images: + name: Build Plus Images + needs: [variables] + strategy: + fail-fast: false + matrix: + include: + - tag: ${{ needs.variables.outputs.tag }} + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" + image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic/nginx-plus-ingress + target_image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic/nginx-plus-ingress + platforms: "linux/arm64, linux/amd64" + - tag: ${{ needs.variables.outputs.tag }}-alpine + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-alpine" + image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic/nginx-plus-ingress + target_image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic/nginx-plus-ingress + platforms: "linux/arm64, linux/amd64" + - tag: ${{ needs.variables.outputs.tag }}-alpine-fips + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-alpine-fips" + image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic/nginx-plus-ingress + target_image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic/nginx-plus-ingress + platforms: "linux/arm64, linux/amd64" + - tag: ${{ needs.variables.outputs.tag }}-mktpl + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-mktpl" + image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic/nginx-plus-ingress + target_image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic/nginx-plus-ingress + platforms: "linux/arm64, linux/amd64" + - tag: ${{ needs.variables.outputs.tag }}-alpine-mktpl + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-alpine-mktpl" + image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic/nginx-plus-ingress + target_image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic/nginx-plus-ingress + platforms: "linux/arm64, linux/amd64" + - tag: ${{ needs.variables.outputs.tag }}-alpine-mktpl-fips + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-alpine-mktpl-fips" + image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic/nginx-plus-ingress + target_image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic/nginx-plus-ingress + platforms: "linux/arm64, linux/amd64" + - tag: ${{ needs.variables.outputs.tag }}-ubi + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-ubi" + image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic/nginx-plus-ingress + target_image: gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic/nginx-plus-ingress + platforms: "linux/arm64, linux/amd64, linux/s390x" + uses: ./.github/workflows/patch-image.yml + with: + platforms: ${{ matrix.platforms }} + image: ${{ matrix.image }} + tag: ${{ matrix.tag }} + ic_version: ${{ needs.variables.outputs.tag }} + target_image: ${{ matrix.target_image }} + target_tag: ${{ matrix.target_tag }} + permissions: + contents: read + id-token: write + secrets: inherit - binary: - if: ${{ needs.check.outputs.needs-updating-debian == 'true' || needs.check.outputs.needs-updating-alpine == 'true' || needs.check.outputs.needs-updating-ubi == 'true' || inputs.force == 'true' }} - name: Build binaries - runs-on: ubuntu-22.04 - needs: [check, variables] - steps: - - name: Checkout Repository - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 - with: - fetch-depth: 0 - ref: refs/tags/v${{ needs.variables.outputs.kic-tag }} + patch-plus-nap-images: + name: Build Plus NAP Images + needs: [variables] + strategy: + fail-fast: false + matrix: + include: + - tag: "${{ needs.variables.outputs.tag }}" + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" + image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-nap/nginx-plus-ingress" + target_image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-nap/nginx-plus-ingress" + platforms: "linux/amd64" + - tag: "${{ needs.variables.outputs.tag }}-ubi" + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-ubi" + image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-nap/nginx-plus-ingress" + target_image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-nap/nginx-plus-ingress" + platforms: "linux/amd64" + - tag: "${{ needs.variables.outputs.tag }}-mktpl" + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-mktpl" + image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-nap/nginx-plus-ingress" + target_image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-nap/nginx-plus-ingress" + platforms: "linux/amd64" + - tag: "${{ needs.variables.outputs.tag }}-ubi-mktpl" + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-ubi-mktpl" + image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-nap/nginx-plus-ingress" + target_image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-nap/nginx-plus-ingress" + platforms: "linux/amd64" + - tag: "${{ needs.variables.outputs.tag }}-alpine-fips" + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-alpine-fips" + image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-nap/nginx-plus-ingress" + target_image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-nap/nginx-plus-ingress" + platforms: "linux/amd64" + - tag: "${{ needs.variables.outputs.tag }}" + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" + image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-dos/nginx-plus-ingress" + target_image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-dos/nginx-plus-ingress" + platforms: "linux/amd64" + - tag: "${{ needs.variables.outputs.tag }}-ubi" + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-ubi" + image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-dos/nginx-plus-ingress" + target_image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-dos/nginx-plus-ingress" + platforms: "linux/amd64" + - tag: "${{ needs.variables.outputs.tag }}-ubi-mktpl" + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-ubi-mktpl" + image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-dos/nginx-plus-ingress" + target_image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-dos/nginx-plus-ingress" + platforms: "linux/amd64" + - tag: "${{ needs.variables.outputs.tag }}-mktpl" + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-mktpl" + image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-dos/nginx-plus-ingress" + target_image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-dos/nginx-plus-ingress" + platforms: "linux/amd64" + - tag: "${{ needs.variables.outputs.tag }}" + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" + image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-dos-nap/nginx-plus-ingress" + target_image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-dos-nap/nginx-plus-ingress" + platforms: "linux/amd64" + - tag: "${{ needs.variables.outputs.tag }}-ubi" + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-ubi" + image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-dos-nap/nginx-plus-ingress" + target_image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-dos-nap/nginx-plus-ingress" + platforms: "linux/amd64" + - tag: "${{ needs.variables.outputs.tag }}-ubi-mktpl" + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-ubi-mktpl" + image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-dos-nap/nginx-plus-ingress" + target_image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-dos-nap/nginx-plus-ingress" + platforms: "linux/amd64" + - tag: "${{ needs.variables.outputs.tag }}-mktpl" + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}-mktpl" + image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/release/nginx-ic-dos-nap/nginx-plus-ingress" + target_image: "gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic-dos-nap/nginx-plus-ingress" + platforms: "linux/amd64" + uses: ./.github/workflows/patch-image.yml + with: + platforms: ${{ matrix.platforms }} + image: ${{ matrix.image }} + tag: ${{ matrix.tag }} + ic_version: ${{ needs.variables.outputs.tag }} + target_image: ${{ matrix.target_image }} + target_tag: ${{ matrix.target_tag }} + permissions: + contents: read + id-token: write + secrets: inherit - - name: Setup Golang Environment - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1 - with: - go-version-file: go.mod + release-oss-internal: + name: "Publish Docker OSS ${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }} to internal release Registries" + needs: [variables, patch-oss-images] + uses: ./.github/workflows/oss-release.yml + with: + gcr_release_registry: true + ecr_public_registry: false + dockerhub_public_registry: false + quay_public_registry: false + github_public_registry: false + source_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" + dry_run: ${{ inputs.dry_run || false }} + permissions: + contents: read + id-token: write + secrets: inherit - - name: Determine GOPATH - id: go - run: echo "go_path=$(go env GOPATH)" >> $GITHUB_OUTPUT + release-oss-public: + name: Publish Docker OSS ${{ needs.variables.outputs.tag }} to Public Registries + needs: [variables, patch-oss-images] + uses: ./.github/workflows/oss-release.yml + with: + gcr_release_registry: false + ecr_public_registry: true + dockerhub_public_registry: true + quay_public_registry: true + github_public_registry: true + source_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" + target_tag: ${{ needs.variables.outputs.tag }} + dry_run: ${{ inputs.dry_run || true }} + permissions: + contents: read + id-token: write + secrets: inherit - - name: Build binaries - uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0 - with: - version: latest - args: build --clean --id kubernetes-ingress - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - GOPATH: ${{ steps.go.outputs.go_path }} - if: ${{ needs.variables.outputs.binary-cache-hit != 'true' }} - - - name: Store Artifacts in Cache - uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2 - with: - path: ${{ github.workspace }}/dist - key: nginx-ingress-${{ needs.variables.outputs.go-md5 }} - if: ${{ needs.variables.outputs.binary-cache-hit != 'true' }} - - release-docker-debian: - name: Release Debian Image - needs: [binary, check, variables] - uses: ./.github/workflows/build-oss.yml + release-plus-nginx-registry: + name: Publish Docker Plus ${{ needs.variables.outputs.tag }} to NGINX registry + needs: [variables, patch-plus-images, patch-plus-nap-images] + strategy: + fail-fast: false + matrix: + tag: + - "${{ needs.variables.outputs.tag }}" + - "${{ needs.variables.outputs.short_tag }}" + - "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" + - "latest" + uses: ./.github/workflows/plus-release.yml with: - platforms: linux/arm,linux/arm64,linux/amd64,linux/ppc64le,linux/s390x - image: debian - tag: ${{ needs.variables.outputs.kic-tag }} - go-md5: ${{ needs.variables.outputs.go-md5 }} - base-image-md5: ${{ needs.variables.outputs.base-image-md5 }} + nginx_registry: true + gcr_release_registry: false + gcr_mktpl_registry: false + ecr_mktpl_registry: false + az_mktpl_registry: false + source_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" + target_tag: ${{ matrix.tag }} + dry_run: ${{ inputs.dry_run || true }} permissions: contents: read - actions: read - security-events: write id-token: write - packages: write secrets: inherit - if: ${{ needs.check.outputs.needs-updating-debian == 'true' || inputs.force == 'true' }} - release-docker-alpine: - name: Release Alpine Image - needs: [binary, check, variables] - uses: ./.github/workflows/build-oss.yml + release-plus-marketplace: + name: Publish Docker Plus ${{ needs.variables.outputs.tag }} to Marketplace registries + needs: [variables, patch-plus-images, patch-plus-nap-images] + uses: ./.github/workflows/plus-release.yml with: - platforms: linux/arm,linux/arm64,linux/amd64,linux/ppc64le,linux/s390x - image: alpine - tag: ${{ needs.variables.outputs.kic-tag }} - go-md5: ${{ needs.variables.outputs.go-md5 }} - base-image-md5: ${{ needs.variables.outputs.base-image-md5 }} + nginx_registry: false + gcr_release_registry: false + gcr_mktpl_registry: true + ecr_mktpl_registry: true + az_mktpl_registry: true + source_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" + dry_run: ${{ inputs.dry_run || false }} permissions: contents: read - actions: read - security-events: write id-token: write - packages: write secrets: inherit - if: ${{ needs.check.outputs.needs-updating-alpine == 'true' || inputs.force == 'true' }} - release-docker-ubi: - name: Release UBI Image - needs: [binary, check, variables] - uses: ./.github/workflows/build-oss.yml + release-plus-internal: + name: Publish Docker Plus ${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }} to internal release Registries + needs: [variables, patch-plus-images, patch-plus-nap-images] + uses: ./.github/workflows/plus-release.yml with: - platforms: linux/arm64,linux/amd64,linux/ppc64le,linux/s390x - image: ubi - tag: ${{ needs.variables.outputs.kic-tag }} - go-md5: ${{ needs.variables.outputs.go-md5 }} - base-image-md5: ${{ needs.variables.outputs.base-image-md5 }} + nginx_registry: false + gcr_release_registry: true + gcr_mktpl_registry: false + ecr_mktpl_registry: false + az_mktpl_registry: false + source_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" + target_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" + dry_run: ${{ inputs.dry_run || false }} permissions: contents: read - actions: read - security-events: write id-token: write - packages: write secrets: inherit - if: ${{ needs.check.outputs.needs-updating-ubi == 'true' || inputs.force == 'true' }} + + certify-openshift-images: + name: Certify OpenShift UBI images + runs-on: ubuntu-22.04 + needs: [variables, release-oss-public] + steps: + - name: Checkout Repository + uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2 + + - name: Certify UBI OSS images in quay + uses: ./.github/actions/certify-openshift-image + with: + image: quay.io/nginx/nginx-ingress:${{ needs.variables.outputs.tag }}-ubi + project_id: ${{ secrets.CERTIFICATION_PROJECT_ID }} + pyxis_token: ${{ secrets.PYXIS_API_TOKEN }} + platforms: "" + if: ${{ ! inputs.dry_run || false }} diff --git a/Makefile b/Makefile index 8dcc541f0d..c44a581c90 100644 --- a/Makefile +++ b/Makefile @@ -184,6 +184,10 @@ ubi-image-nap-dos-plus: build ## Create Docker image for Ingress Controller (UBI .PHONY: all-images ## Create all the Docker images for Ingress Controller all-images: alpine-image alpine-image-plus alpine-image-plus-fips alpine-image-nap-plus-fips debian-image debian-image-plus debian-image-nap-plus debian-image-dos-plus debian-image-nap-dos-plus ubi-image ubi-image-plus ubi-image-nap-plus ubi-image-dos-plus ubi-image-nap-dos-plus +.PHONY: patch-os +patch-os: ## Patch supplied image + $(DOCKER_CMD) --build-arg IMAGE_NAME=$(IMAGE) + .PHONY: push push: ## Docker push to PREFIX and TAG docker push $(strip $(PREFIX)):$(strip $(TAG)) diff --git a/build/Dockerfile b/build/Dockerfile index bf522c6417..526e4dab99 100644 --- a/build/Dockerfile +++ b/build/Dockerfile @@ -5,6 +5,7 @@ ARG DOWNLOAD_TAG=edge ARG DEBIAN_FRONTEND=noninteractive ARG PREBUILT_BASE_IMG=nginx/nginx-ingress:${DOWNLOAD_TAG} ARG NGINX_AGENT=false +ARG IMAGE_NAME=nginx/nginx-ingress ############################################# Base images containing libs for Opentracing and FIPS ############################################# @@ -19,11 +20,9 @@ FROM nginx:1.26.0-alpine@sha256:ca16009a8c25f52193506d4c90c98efbad4b6cbe73372e2a RUN --mount=type=bind,from=alpine-opentracing-lib,target=/tmp/ot/ \ apk add --no-cache libcap libstdc++ \ - && apk upgrade --no-cache -U \ && cp -av /tmp/ot/usr/local/lib/libopentracing.so* /tmp/ot/usr/local/lib/libjaegertracing*so* /tmp/ot/usr/local/lib/libzipkin*so* /tmp/ot/usr/local/lib/libdd*so* /tmp/ot/usr/local/lib/libyaml*so* /usr/local/lib/ \ && cp -av /tmp/ot/usr/lib/nginx/modules/ngx_http_opentracing_module.so /usr/lib/nginx/modules/ \ - && ldconfig /usr/local/lib/ \ - && apk cache clean + && ldconfig /usr/local/lib/ ############################################# Base image for Debian ############################################# @@ -31,9 +30,7 @@ FROM nginx:1.26.0@sha256:ba9587717b056e1993b051f71cea30ddd5caf09ae2087b1eeb11329 RUN --mount=type=bind,from=opentracing-lib,target=/tmp/ot/ \ apt-get update \ - && apt-get upgrade -y \ && apt-get install --no-install-recommends --no-install-suggests -y libcap2-bin \ - && rm -rf /var/lib/apt/lists/* \ && cp -av /tmp/ot/usr/local/lib/libopentracing.so* /tmp/ot/usr/local/lib/libjaegertracing*so* /tmp/ot/usr/local/lib/libzipkin*so* /tmp/ot/usr/local/lib/libdd*so* /tmp/ot/usr/local/lib/libyaml*so* /usr/local/lib/ \ && cp -av /tmp/ot/usr/lib/nginx/modules/ngx_http_opentracing_module.so /usr/lib/nginx/modules/ \ && ldconfig @@ -54,8 +51,6 @@ LABEL name="NGINX Ingress Controller" \ io.openshift.tags="nginx,ingress-controller,ingress,controller,kubernetes,openshift" COPY --link --chown=101:0 LICENSE /licenses/ -RUN microdnf update -y \ - && microdnf clean all ############################################# NGINX files for NGINX Plus ############################################# @@ -88,6 +83,22 @@ RUN --mount=from=busybox:musl,src=/bin/,dst=/bin/ printf "%s\n" "Acquire::https: && echo HTTP_USER_AGENT="k8s-ic-$IC_VERSION${BUILD_OS##alpine-plus}-apk" > user_agent ADD --link --chown=101:0 https://cs.nginx.com/static/files/nginx-agent.repo nginx-agent.repo +ADD --link --chown=101:0 --chmod=0755 https://raw.githubusercontent.com/nginxinc/k8s-common/main/files/patch-os.sh patch-os.sh + + +############################################# Patch Image ############################################# +FROM ${IMAGE_NAME} as patched +ARG IMAGE_NAME +ARG IC_VERSION + +LABEL version="${IC_VERSION}" \ + org.opencontainers.image.version="${IC_VERSION}" + +USER 0 +RUN --mount=type=bind,from=nginx-files,src=patch-os.sh,target=/usr/local/bin/patch-os.sh \ + if [ -f /etc/apk/repositories ]; then sed -i -e '/nginx.com/d' /etc/apk/repositories; fi \ + && patch-os.sh +USER 101 ############################################# Base image for Alpine with NGINX Plus ############################################# FROM alpine:3.19@sha256:c5b1261d6d3e43071626931fc004f70149baeba2c8ec672bd4f27761f8e1ad6b as alpine-plus @@ -100,11 +111,10 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/apk/cert.pem,mode=0644 \ --mount=type=bind,from=nginx-files,src=user_agent,target=/tmp/user_agent \ export $(cat /tmp/user_agent) \ && printf "%s\n" "https://pkgs.nginx.com/plus/${NGINX_PLUS_VERSION}/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \ - && apk upgrade --no-cache -U \ && apk add --no-cache nginx-plus nginx-plus-module-njs nginx-plus-module-opentracing nginx-plus-module-fips-check libcap libcurl \ && cp -av /tmp/ot/usr/local/lib/libjaegertracing*so* /tmp/ot/usr/local/lib/libzipkin*so* /tmp/ot/usr/local/lib/libdd*so* /tmp/ot/usr/local/lib/libyaml*so* /usr/local/lib/ \ && ldconfig /usr/local/lib/ \ - && apk cache clean + && sed -i -e '/nginx.com/d' /etc/apk/repositories ############################################# Base image for Alpine with NGINX Plus and FIPS ############################################# @@ -131,7 +141,6 @@ RUN --mount=type=bind,from=alpine-fips-3.17,target=/tmp/fips/ \ && printf "%s\n" "https://pkgs.nginx.com/app-protect/${NGINX_PLUS_VERSION}/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \ && printf "%s\n" "https://pkgs.nginx.com/app-protect-security-updates/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \ && printf "%s\n" "https://pkgs.nginx.com/nginx-agent/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \ - && apk upgrade --no-cache -U \ && apk add --no-cache libcap-utils libcurl nginx-plus nginx-plus-module-njs nginx-plus-module-opentracing nginx-plus-module-fips-check \ && if [ -z "${NGINX_AGENT##true}" ]; then apk add --no-cache nginx-agent; fi \ && mkdir -p /usr/ssl \ @@ -140,7 +149,8 @@ RUN --mount=type=bind,from=alpine-fips-3.17,target=/tmp/fips/ \ && cp -av /tmp/fips/etc/ssl/openssl.cnf /etc/ssl/openssl.cnf \ && cp -av /tmp/ot/usr/local/lib/libjaegertracing*so* /tmp/ot/usr/local/lib/libzipkin*so* /tmp/ot/usr/local/lib/libdd*so* /tmp/ot/usr/local/lib/libyaml*so* /usr/local/lib/ \ && ldconfig /usr/local/lib/ \ - && apk add --no-cache app-protect=~31.4.815 app-protect-attack-signatures app-protect-threat-campaigns + && apk add --no-cache app-protect=~31.4.815 app-protect-attack-signatures app-protect-threat-campaigns \ + && sed -i -e '/nginx.com/d' /etc/apk/repositories ############################################# Base image for Debian with NGINX Plus ############################################# @@ -154,7 +164,6 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode --mount=type=bind,from=nginx-files,src=90pkgs-nginx,target=/etc/apt/apt.conf.d/90pkgs-nginx \ --mount=type=bind,from=nginx-files,src=debian-plus-12.sources,target=/etc/apt/sources.list.d/nginx-plus.sources \ apt-get update \ - && apt-get upgrade -y \ && apt-get install --no-install-recommends --no-install-suggests -y sq ca-certificates libcap2-bin libcurl4 \ && groupadd --system --gid 101 nginx \ && useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ @@ -189,7 +198,6 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode cp /tmp/app-protect-dos.sources /etc/apt/sources.list.d/app-protect-dos.sources; \ fi \ && apt-get update \ - && apt-get upgrade -y \ && apt-get install --no-install-recommends --no-install-suggests -y ca-certificates sq \ && groupadd --system --gid 101 nginx \ && useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ @@ -232,7 +240,6 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode --mount=type=bind,from=nginx-files,src=nginx_signing.key,target=/tmp/nginx_signing.key \ --mount=type=bind,from=nginx-files,src=nginx-plus-9.repo,target=/etc/yum.repos.d/nginx-plus.repo \ microdnf --nodocs install -y shadow-utils \ - && microdnf update -y \ && cat /etc/yum.repos.d/nginx-plus.repo \ && groupadd --system --gid 101 nginx \ && useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ @@ -260,7 +267,6 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode fi \ ## the code below is duplicated from the ubi-plus image because NAP WAF doesn't support UBI minimal versions && dnf --nodocs install -y shadow-utils ca-certificates \ - && dnf update -y \ && groupadd --system --gid 101 nginx \ && useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ && rpm --import /tmp/nginx_signing.key \ @@ -307,8 +313,6 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode cp /tmp/app-protect-dos-8.repo /etc/yum.repos.d/app-protect-dos-8.repo; \ fi \ ## the code below is duplicated from the ubi-plus image because NAP DOS doesn't support UBI 9 and minimal versions - && dnf --nodocs install -y shadow-utils ca-certificates \ - && dnf update -y \ && groupadd --system --gid 101 nginx \ && useradd --system --gid nginx --no-create-home --home-dir /nonexistent --comment "nginx user" --shell /bin/false --uid 101 nginx \ && rpm --import /tmp/nginx_signing.key \ @@ -380,6 +384,10 @@ RUN --mount=type=bind,target=/tmp mkdir -p /var/lib/nginx /etc/nginx/secrets /et && chmod -R g=u /etc/nginx /var/cache/nginx /var/lib/nginx /var/log/nginx /*.tmpl \ && rm -f /etc/nginx/conf.d/* +# Patch OS +RUN --mount=type=bind,from=nginx-files,src=patch-os.sh,target=/usr/local/bin/patch-os.sh \ + patch-os.sh + # Uncomment the line below if you would like to add the default.pem to the image # and use it as a certificate and key for the default server # ADD default.pem /etc/nginx/secrets/default From 5e42eae3a2818cd33804b5759539b8ab1cf197e7 Mon Sep 17 00:00:00 2001 From: Paul Abel Date: Fri, 3 May 2024 10:19:09 +0100 Subject: [PATCH 2/5] make oss a matrix strategy --- .github/workflows/update-docker-images.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/update-docker-images.yml b/.github/workflows/update-docker-images.yml index c6bc1aae52..79f1a48900 100644 --- a/.github/workflows/update-docker-images.yml +++ b/.github/workflows/update-docker-images.yml @@ -249,6 +249,14 @@ jobs: release-oss-public: name: Publish Docker OSS ${{ needs.variables.outputs.tag }} to Public Registries needs: [variables, patch-oss-images] + strategy: + fail-fast: false + matrix: + tag: + - "${{ needs.variables.outputs.tag }}" + - "${{ needs.variables.outputs.short_tag }}" + - "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" + - "latest" uses: ./.github/workflows/oss-release.yml with: gcr_release_registry: false @@ -257,7 +265,7 @@ jobs: quay_public_registry: true github_public_registry: true source_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" - target_tag: ${{ needs.variables.outputs.tag }} + target_tag: ${{ matrix.tag }} dry_run: ${{ inputs.dry_run || true }} permissions: contents: read @@ -291,7 +299,7 @@ jobs: secrets: inherit release-plus-marketplace: - name: Publish Docker Plus ${{ needs.variables.outputs.tag }} to Marketplace registries + name: Publish Docker Plus ${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }} to Marketplace registries needs: [variables, patch-plus-images, patch-plus-nap-images] uses: ./.github/workflows/plus-release.yml with: From ed4b1dda7f56ec9deb33635af6255739ea9976bc Mon Sep 17 00:00:00 2001 From: Paul Abel Date: Fri, 3 May 2024 10:36:18 +0100 Subject: [PATCH 3/5] make sure gcr get x.y & x.y.z tags --- .github/workflows/update-docker-images.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/update-docker-images.yml b/.github/workflows/update-docker-images.yml index 79f1a48900..55db3c838f 100644 --- a/.github/workflows/update-docker-images.yml +++ b/.github/workflows/update-docker-images.yml @@ -272,8 +272,8 @@ jobs: id-token: write secrets: inherit - release-plus-nginx-registry: - name: Publish Docker Plus ${{ needs.variables.outputs.tag }} to NGINX registry + release-plus-nginx-gcr: + name: Publish Docker Plus ${{ needs.variables.outputs.tag }} to NGINX & GCR Marketplace registries needs: [variables, patch-plus-images, patch-plus-nap-images] strategy: fail-fast: false @@ -287,7 +287,7 @@ jobs: with: nginx_registry: true gcr_release_registry: false - gcr_mktpl_registry: false + gcr_mktpl_registry: true ecr_mktpl_registry: false az_mktpl_registry: false source_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" @@ -298,14 +298,14 @@ jobs: id-token: write secrets: inherit - release-plus-marketplace: - name: Publish Docker Plus ${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }} to Marketplace registries + release-plus-azure-ecr-marketplace: + name: Publish Docker Plus ${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }} to Azure & ECR Marketplace registries needs: [variables, patch-plus-images, patch-plus-nap-images] uses: ./.github/workflows/plus-release.yml with: nginx_registry: false gcr_release_registry: false - gcr_mktpl_registry: true + gcr_mktpl_registry: false ecr_mktpl_registry: true az_mktpl_registry: true source_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" From 6fb67d4de282a2c38851f1e2c407a5fe9bc77811 Mon Sep 17 00:00:00 2001 From: Paul Abel Date: Fri, 3 May 2024 10:46:12 +0100 Subject: [PATCH 4/5] enable publishing of plus images --- .github/workflows/update-docker-images.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/update-docker-images.yml b/.github/workflows/update-docker-images.yml index 55db3c838f..f496521dfd 100644 --- a/.github/workflows/update-docker-images.yml +++ b/.github/workflows/update-docker-images.yml @@ -266,7 +266,7 @@ jobs: github_public_registry: true source_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" target_tag: ${{ matrix.tag }} - dry_run: ${{ inputs.dry_run || true }} + dry_run: ${{ inputs.dry_run || false }} permissions: contents: read id-token: write @@ -292,7 +292,7 @@ jobs: az_mktpl_registry: false source_tag: "${{ needs.variables.outputs.tag }}-${{ needs.variables.outputs.date }}" target_tag: ${{ matrix.tag }} - dry_run: ${{ inputs.dry_run || true }} + dry_run: ${{ inputs.dry_run || false }} permissions: contents: read id-token: write From 3f707722637ed171d138dab326b06abd181c745b Mon Sep 17 00:00:00 2001 From: Paul Abel <128620221+pdabelf5@users.noreply.github.com> Date: Fri, 3 May 2024 11:16:06 +0100 Subject: [PATCH 5/5] Update .github/actions/certify-openshift-image/action.yml Co-authored-by: Shaun Signed-off-by: Paul Abel <128620221+pdabelf5@users.noreply.github.com> --- .github/actions/certify-openshift-image/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/certify-openshift-image/action.yml b/.github/actions/certify-openshift-image/action.yml index cf13cd5da1..f9d423210c 100644 --- a/.github/actions/certify-openshift-image/action.yml +++ b/.github/actions/certify-openshift-image/action.yml @@ -1,5 +1,5 @@ name: Certify Openshift Image -description: This action with attempt to certify an image for use in Openshift +description: This action will attempt to certify an image for use in Openshift inputs: image: