diff --git a/.github/workflows/k8s-content-pr.yaml b/.github/workflows/k8s-content-pr.yaml index e853d89ced81..13777af3192d 100644 --- a/.github/workflows/k8s-content-pr.yaml +++ b/.github/workflows/k8s-content-pr.yaml @@ -91,7 +91,7 @@ jobs: tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} push: true - platforms: 'linux/amd64' + platforms: 'linux/amd64,linux/ppc64le,linux/s390x' - name: Get container info id: container_info run: | diff --git a/.github/workflows/k8s-content.yaml b/.github/workflows/k8s-content.yaml index 13322675f48f..aaa151bf7363 100644 --- a/.github/workflows/k8s-content.yaml +++ b/.github/workflows/k8s-content.yaml @@ -11,12 +11,44 @@ jobs: contents: read id-token: write packages: write - uses: metal-toolbox/container-push/.github/workflows/container-push.yml@main - with: - name: k8scontent - tag: ${GITHUB_SHA} - latest: true - registry_org: complianceascode - dockerfile_path: ./Dockerfiles/ocp4_content - licenses: BSD - vendor: ComplianceAsCode authors + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Login to ghcr.io + uses: docker/login-action@v3.2.0 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + - name: Docker metadata + id: meta + uses: docker/metadata-action@v5 + with: + images: ghcr.io/complianceascode/k8scontent + flavor: | + latest=true + tags: | + type=raw,value=${GITHUB_SHA} + type=sha,format=long + labels: | + org.opencontainers.image.source=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY} + org.opencontainers.image.title=Kubernetes content + org.opencontainers.image.version=${GITHUB_SHA} + org.opencontainers.image.licenses='BSD-3-Clause' + org.opencontainers.image.vendor='Compliance Operator Authors' + - name: Build container images and push + id: docker_build + uses: docker/build-push-action@v5 + with: + context: . + file: ./Dockerfiles/ocp4_content + tags: ${GITHUB_SHA} + labels: true + push: true + platforms: 'linux/amd64,linux/ppc64le,linux/s390x' diff --git a/Dockerfiles/ocp4_content b/Dockerfiles/ocp4_content index 501c0516e61d..67a28c0a7944 100644 --- a/Dockerfiles/ocp4_content +++ b/Dockerfiles/ocp4_content @@ -1,5 +1,3 @@ -# This dockerfile builds the content in the current repo for OCP4 - FROM registry.fedoraproject.org/fedora-minimal:latest as builder WORKDIR /content @@ -8,10 +6,47 @@ RUN microdnf -y install cmake make git /usr/bin/python3 python3-pyyaml python3-j COPY . . -RUN ./build_product --datastream-only --debug ocp4 rhcos4 eks +# Enable the default.profiles as they maintain a list rules to be added to the datastream +RUN find . -name "default\.profile" -exec sed -i 's/\(documentation_complete: \).*/\1true/' '{}' \; + +# Enable only certain profiles on ppc64le and s390x +RUN if [ "$(uname -m)" == "x86_64" ]; then \ + echo "Building OpenShift and RHCOS content for x86_64"; \ + else echo "Building OpenShift content for $(uname -m)" && \ + find . -name "*.profile" -exec sed -i 's/\(documentation_complete: \).*/\1false/' '{}' \; && \ + sed -i 's/\(documentation_complete: \).*/\1true/' \ + products/ocp4/profiles/pci-dss-node-3-2.profile \ + products/ocp4/profiles/pci-dss-3-2.profile \ + products/ocp4/profiles/pci-dss-node.profile \ + products/ocp4/profiles/pci-dss.profile \ + products/ocp4/profiles/cis-node.profile \ + products/ocp4/profiles/cis.profile \ + products/ocp4/profiles/cis-node-1-4.profile \ + products/ocp4/profiles/cis-1-4.profile \ + products/ocp4/profiles/cis-node-1-5.profile \ + products/ocp4/profiles/cis-1-5.profile \ + products/ocp4/profiles/moderate-node.profile \ + products/ocp4/profiles/moderate.profile \ + products/ocp4/profiles/moderate-node-rev-4.profile \ + products/ocp4/profiles/moderate-rev-4.profile; \ + fi + + +# OCPBUGS-32794: Ensure stability of rules shipped +# Before building the content we re-enable all profiles as hidden, this will include any rule selected +# by these profiles in the data stream without creating a profile for them. +RUN grep -lr 'documentation_complete: false' ./products | xargs -I '{}' \ + sed -i -e 's/\(documentation_complete: \).*/\1true/' -e '/documentation_complete/a hidden: true' {} + +# Build the OpenShift and RHCOS content for x86 architectures. Only build +# OpenShift content for ppc64le and s390x architectures since we're not +# including any RHCOS profiles on those architectures right now anyway. +RUN if [ "$(uname -m)" = "x86_64" ]; then \ + ./build_product ocp4 rhcos4 --datastream-only; \ + else ./build_product ocp4 --datastream-only; \ + fi FROM registry.access.redhat.com/ubi8/ubi-micro:latest + WORKDIR / -COPY --from=builder /content/build/ssg-ocp4-ds.xml . -COPY --from=builder /content/build/ssg-rhcos4-ds.xml . -COPY --from=builder /content/build/ssg-eks-ds.xml . +COPY --from=builder /content/build/ssg-*-ds.xml .