Update dependencies & add ci (#9)

* Update deps & add ci

.dockerignore

@@ -0,0 +1,13 @@
+.editorconfig
+.git
+AUTHORS.md
+CONTRIBUTING.md
+LICENSE
+Makefile
+README.md
+deploy/
+vendor/
+testdata/
+scripts/
+_test/
+_out/

.github/ct.yaml

@@ -0,0 +1,3 @@
+helm-extra-args: --timeout 600s
+check-version-increment: true
+debug: true

.github/kubeval.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+set -euo pipefail
+
+CHART_DIRS="$(git diff --find-renames --name-only "$(git rev-parse --abbrev-ref HEAD)" remotes/origin/master -- deploy | grep '[cC]hart.yaml' | sed -e 's#/[Cc]hart.yaml##g')"
+KUBEVAL_VERSION="v0.16.1"
+SCHEMA_LOCATION="https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master"
+
+# install kubeval
+curl --silent --show-error --fail --location --output /tmp/kubeval.tar.gz https://github.com/instrumenta/kubeval/releases/download/"${KUBEVAL_VERSION}"/kubeval-linux-amd64.tar.gz
+tar -xf /tmp/kubeval.tar.gz kubeval
+
+# validate charts
+for CHART_DIR in ${CHART_DIRS}; do
+  helm template "${CHART_DIR}" | ./kubeval --strict --ignore-missing-schemas --kubernetes-version "${KUBERNETES_VERSION#v}" --schema-location "${SCHEMA_LOCATION}" --ignore-missing-schemas
+done

.github/workflows/pr-ci-chart.yaml

@@ -0,0 +1,84 @@
+name: Lint and Test Charts
+
+on:
+  pull_request:
+    paths:
+      - 'deploy/**'
+
+jobs:
+  lint-chart:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v1
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v1
+        with:
+          version: v3.4.1
+
+      - name: Set up Python
+        uses: actions/setup-python@v2
+        with:
+          python-version: 3.7
+
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@v2.1.0
+        with:
+          version: v3.4.0
+
+      - name: Run chart-testing (list-changed)
+        id: list-changed
+        run: |
+          changed=$(ct list-changed --config .github/ct.yaml)
+          if [[ -n "$changed" ]]; then
+            echo "::set-output name=changed::true"
+          fi
+
+      - name: Run chart-testing (lint)
+        run: ct lint --config .github/ct.yaml
+
+  kubeval-chart:
+    runs-on: ubuntu-latest
+    needs:
+      - lint-chart
+    strategy:
+      matrix:
+        k8s:
+          - v1.17.14
+          - v1.19.4
+          - v1.21.6
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v1
+      - name: Run kubeval
+        env:
+          KUBERNETES_VERSION: ${{ matrix.k8s }}
+        run: .github/kubeval.sh
+
+  # install-chart:
+  #   name: install-chart
+  #   runs-on: ubuntu-latest
+  #   needs:
+  #     - lint-chart
+  #     - kubeval-chart
+  #   strategy:
+  #     matrix:
+  #       k8s:
+  #         - v1.17.14
+  #         - v1.19.4
+  #         - v1.21.6
+  #   steps:
+  #     - name: Checkout
+  #       uses: actions/checkout@v1
+  #     - name: Create kind ${{ matrix.k8s }} cluster
+  #       uses: helm/kind-action@main
+  #       with:
+  #         node_image: kindest/node:${{ matrix.k8s }}
+  #     - name: Run chart-testing (install)
+  #       uses: helm/chart-testing-action@main
+  #       with:
+  #         command: install
+  #         config: .github/ct.yaml

.github/workflows/release-chart.yaml

@@ -0,0 +1,27 @@
+name: Release Chart
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  release-helm-chart:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
+
+      - name: Run chart-releaser
+        uses: helm/chart-releaser-action@v1.1.0
+        with:
+          charts_dir: deploy
+        env:
+          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/release-docker.yaml

@@ -0,0 +1,42 @@
+name: Release Dockerimage
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -13,5 +13,7 @@
 # Output of the go coverage tool, specifically when used with LiteIDE
 *.out
 _out
+_test
 .out
+vendor
 

.travis.yml

@@ -1,9 +1,9 @@
 sudo: false
 language: go
 install:
-  - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.23.3
+  - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.43.0
 go:
-  - "1.13"
+  - "1.17"
 script:
   - make golangci-lint
   - make unit-tests

Dockerfile

@@ -1,25 +1,13 @@
-FROM golang:1.13.8-alpine AS build_deps
-
+FROM golang:1.17.3-alpine AS build
 RUN apk add --no-cache git
-
 WORKDIR /workspace
 ENV GO111MODULE=on
-
-COPY go.mod .
-COPY go.sum .
-
-RUN go mod download
-
-FROM build_deps AS build
-
 COPY . .
-
+RUN go mod download
 RUN CGO_ENABLED=0 go build -o webhook -ldflags '-w -extldflags "-static"' .
 
-FROM alpine:3.9
-
+# ------------------------------
+FROM alpine:3.14.2
 RUN apk add --no-cache ca-certificates
-
 COPY --from=build /workspace/webhook /usr/local/bin/webhook
-
 ENTRYPOINT ["webhook"]

Makefile

@@ -1,21 +1,50 @@
+OS ?= $(shell go env GOOS)
+ARCH ?= $(shell go env GOARCH)
+
+ifeq (Darwin, $(shell uname))
+	GREP_PREGEX_FLAG := E
+else
+	GREP_PREGEX_FLAG := P
+endif
+
+GO_VERSION ?= $(shell go mod edit -json | grep -${GREP_PREGEX_FLAG}o '"Go":\s+"([0-9.]+)"' | sed -E 's/.+"([0-9.]+)"/\1/')
+
 IMAGE_NAME := "selectel/cert-manager-webhook-selectel"
 IMAGE_TAG := "latest"
 
-OUT := $(shell pwd)/.out
+K8S_VERSION=1.21.2
+
+OUT := $(shell pwd)/_out
 
 $(shell mkdir -p "$(OUT)")
 
-verify:
-	sh ./scripts/fetch-test-binaries.sh
+test: _test/kubebuilder
+	TEST_ASSET_ETCD=_test/kubebuilder/bin/etcd \
+	TEST_ASSET_KUBE_APISERVER=_test/kubebuilder/bin/kube-apiserver \
+	TEST_ASSET_KUBECTL=_test/kubebuilder/bin/kubectl \
 	go test -v .
 
+_test/kubebuilder:
+	mkdir -p _test/kubebuilder
+	curl -sSLo envtest-bins.tar.gz "https://go.kubebuilder.io/test-tools/${K8S_VERSION}/${OS}/${ARCH}"
+	tar -C _test/kubebuilder --strip-components=1 -zvxf envtest-bins.tar.gz
+	rm envtest-bins.tar.gz
+
+clean: clean-kubebuilder
+
+clean-kubebuilder:
+	rm -Rf _test/kubebuilder
+
 build:
 	docker build -t $(IMAGE_NAME):$(IMAGE_TAG) .
 
-golangci-lint:
+vendor:
+	go mod vendor
+
+golangci-lint: vendor
 	@sh -c "'$(CURDIR)/scripts/golangci_lint_check.sh'"
 
-unit-tests:
+unit-tests: vendor
 	@sh -c "'$(CURDIR)/scripts/unit_tests.sh'"
 
 .PHONY: rendered-manifest.yaml golangci-lint unit-tests

README.md

@@ -8,10 +8,18 @@ Cert-manager ACME DNS webhook provider for Selectel.
 
 To install with helm, run:
 
+```bash
+$ helm repo add selectel https://selectel.github.io/cert-manager-webhook-selectel
+$ helm repo update
+$ helm install --name cert-manager-webhook-selectel selectel/cert-manager-webhook-selectel
+```
+
+OR
+
 ```bash
 $ git clone https://github.com/selectel/cert-manager-webhook-selectel.git
 $ cd cert-manager-webhook-selectel/deploy/cert-manager-webhook-selectel
-$ helm install --name cert-manager-webhook-selectel . --set groupName acme.selectel.ru
+$ helm install --name cert-manager-webhook-selectel .
 ```
 
 Without helm, run:
@@ -92,6 +100,5 @@ You can run the test suite with:
 2. Fill in the appropriate values in `testdata/selectel/apikey.yml` and `testdata/selectel/config.json` 
 
 ```bash
-$ ./scripts/fetch-test-binaries.sh
-$ TEST_ZONE_NAME=example.com. go test .
+$ TEST_ZONE_NAME=example.com. make test
 ```

deploy/cert-manager-webhook-selectel/Chart.yaml

@@ -1,5 +1,10 @@
+---
 apiVersion: v1
-appVersion: "1.0"
-description: Selectel DNS cert-manager ACME webhook
 name: cert-manager-webhook-selectel
-version: 0.2.1
+appVersion: "1.2.0"
+description: Selectel DNS cert-manager ACME webhook
+maintainers:
+  - name: andrsp
+    email: izotikov@selectel.ru
+    url: https://github.com/andrsp
+version: 1.2.0

deploy/cert-manager-webhook-selectel/templates/apiservice.yaml

@@ -1,3 +1,4 @@
+---
 apiVersion: apiregistration.k8s.io/v1
 kind: APIService
 metadata:

deploy/cert-manager-webhook-selectel/templates/deployment.yaml

@@ -1,3 +1,4 @@
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:

deploy/cert-manager-webhook-selectel/templates/pki.yaml

@@ -29,7 +29,7 @@ metadata:
     heritage: {{ .Release.Service }}
 spec:
   secretName: {{ include "cert-manager-webhook-selectel.rootCACertificate" . }}
-  duration: 43800h # 5y
+  duration: 43800h  # 5y
   issuerRef:
     name: {{ include "cert-manager-webhook-selectel.selfSignedIssuer" . }}
   commonName: "ca.cert-manager-webhook-selectel.cert-manager"
@@ -67,10 +67,10 @@ metadata:
     heritage: {{ .Release.Service }}
 spec:
   secretName: {{ include "cert-manager-webhook-selectel.servingCertificate" . }}
-  duration: 8760h # 1y
+  duration: 8760h  # 1y
   issuerRef:
     name: {{ include "cert-manager-webhook-selectel.rootCAIssuer" . }}
   dnsNames:
-  - {{ include "cert-manager-webhook-selectel.fullname" . }}
-  - {{ include "cert-manager-webhook-selectel.fullname" . }}.{{ .Release.Namespace }}
-  - {{ include "cert-manager-webhook-selectel.fullname" . }}.{{ .Release.Namespace }}.svc
+    - {{ include "cert-manager-webhook-selectel.fullname" . }}
+    - {{ include "cert-manager-webhook-selectel.fullname" . }}.{{ .Release.Namespace }}
+    - {{ include "cert-manager-webhook-selectel.fullname" . }}.{{ .Release.Namespace }}.svc