Skip to content

Commit 92e6d1c

Browse files
bertiethorpebertiethorpe
committed
new changes
1 parent 47391ad commit 92e6d1c

File tree

3 files changed

+138
-27
lines changed

3 files changed

+138
-27
lines changed

‎.github/workflows/fatimage-cron.yml

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
name: Nightly fat image build
2+
on:
3+
workflow_dispatch:
4+
schedule:
5+
- cron: '0 0 * * *' # Run at midnight
6+
7+
jobs:
8+
openstack:
9+
name: openstack-imagebuild
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.os_version }}-${{ matrix.build }} # to branch/PR + OS + build
12+
cancel-in-progress: true
13+
runs-on: ubuntu-22.04
14+
strategy:
15+
fail-fast: false # allow other matrix jobs to continue even if one fails
16+
matrix: # build RL8+OFED, RL9+OFED base images
17+
os_version:
18+
- RL8
19+
- RL9
20+
build:
21+
- openstack.openhpc-latest
22+
env:
23+
ANSIBLE_FORCE_COLOR: True
24+
OS_CLOUD: openstack
25+
CI_CLOUD: ${{ vars.CI_CLOUD }}
26+
steps:
27+
- uses: actions/checkout@v2
28+
29+
- name: Setup ssh
30+
run: |
31+
set -x
32+
mkdir ~/.ssh
33+
echo "${{ secrets[format('{0}_SSH_KEY', vars.CI_CLOUD)] }}" > ~/.ssh/id_rsa
34+
chmod 0600 ~/.ssh/id_rsa
35+
shell: bash
36+
37+
- name: Add bastion's ssh key to known_hosts
38+
run: cat environments/.stackhpc/bastion_fingerprints >> ~/.ssh/known_hosts
39+
shell: bash
40+
41+
- name: Install ansible etc
42+
run: dev/setup-env.sh
43+
44+
- name: Write clouds.yaml
45+
run: |
46+
mkdir -p ~/.config/openstack/
47+
echo "${{ secrets[format('{0}_CLOUDS_YAML', vars.CI_CLOUD)] }}" > ~/.config/openstack/clouds.yaml
48+
shell: bash
49+
50+
- name: Setup environment
51+
run: |
52+
. venv/bin/activate
53+
. environments/.stackhpc/activate
54+
55+
- name: Build fat image with packer
56+
id: packer_build
57+
run: |
58+
set -x
59+
. venv/bin/activate
60+
. environments/.stackhpc/activate
61+
cd packer/
62+
packer init .
63+
64+
PACKER_LOG=1 packer build \
65+
-on-error=${{ vars.PACKER_ON_ERROR }} \
66+
-only=${{ matrix.build }} \
67+
-var-file=$PKR_VAR_environment_root/${{ vars.CI_CLOUD }}.pkrvars.hcl \
68+
openstack.pkr.hcl
69+
env:
70+
PKR_VAR_os_version: ${{ matrix.os_version }}
71+
72+
- name: Get created image names from manifest
73+
id: manifest
74+
run: |
75+
. venv/bin/activate
76+
IMAGE_ID=$(jq --raw-output '.builds[-1].artifact_id' packer/packer-manifest.json)
77+
while ! openstack image show -f value -c name $IMAGE_ID; do
78+
sleep 5
79+
done
80+
IMAGE_NAME=$(openstack image show -f value -c name $IMAGE_ID)
81+
echo "image-name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"
82+
echo "image-id=$IMAGE_ID" >> "$GITHUB_OUTPUT"
83+
84+
- name: Download image
85+
run: |
86+
. venv/bin/activate
87+
sudo mkdir /mnt/images
88+
sudo chmod 777 /mnt/images
89+
openstack image save --file /mnt/images/${{ steps.manifest.outputs.image-name }}.qcow2 ${{ steps.manifest.outputs.image-name }}
90+
91+
- name: Set up QEMU
92+
uses: docker/setup-qemu-action@v3
93+
94+
- name: install libguestfs
95+
run: |
96+
sudo apt -y update
97+
sudo apt -y install libguestfs-tools
98+
99+
- name: mkdir for mount
100+
run: sudo mkdir -p './${{ steps.manifest.outputs.image-name }}'
101+
102+
- name: mount qcow2 file
103+
run: sudo guestmount -a /mnt/images/${{ steps.manifest.outputs.image-name }}.qcow2 -i --ro -o allow_other './${{ steps.manifest.outputs.image-name }}'
104+
105+
- name: Run Trivy vulnerability scanner
106+
uses: aquasecurity/[email protected]
107+
with:
108+
scan-type: fs
109+
scan-ref: "${{ steps.manifest.outputs.image-name }}"
110+
scanners: "vuln"
111+
format: sarif
112+
output: "${{ steps.manifest.outputs.image-name }}.sarif"
113+
# turn off secret scanning to speed things up
114+
115+
- name: Upload Trivy scan results to GitHub Security tab
116+
uses: github/codeql-action/upload-sarif@v3
117+
with:
118+
sarif_file: "${{ steps.manifest.outputs.image-name }}.sarif"
119+
category: "${{ matrix.os_version }}-${{ matrix.build }}"
120+
121+
- name: Fail if scan has CRITICAL vulnerabilities
122+
uses: aquasecurity/[email protected]
123+
with:
124+
scan-type: fs
125+
scan-ref: "${{ steps.manifest.outputs.image-name }}"
126+
scanners: "vuln"
127+
format: table
128+
exit-code: '1'
129+
severity: 'CRITICAL'
130+
ignore-unfixed: true

‎.github/workflows/fatimage.yml

Lines changed: 2 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -66,30 +66,11 @@ jobs:
6666
cd packer/
6767
packer init .
6868
69-
MATRIX_BUILD="${{ matrix.build }}"
70-
CLEAN_BUILD="${MATRIX_BUILD#openstack.}"
71-
# SOURCE_IMAGE_NAME="${CLEAN_BUILD}-${{ matrix.os_version }}-latest"
72-
SOURCE_IMAGE_NAME="{
73-
RL8: "${CLEAN_BUILD}-${{ matrix.os_version }}-latest"
74-
RL9: "${CLEAN_BUILD}-${{ matrix.os_version }}-latest"
75-
}"
76-
IMAGE_NAME="${CLEAN_BUILD}-${{ matrix.os_version }}-latest"
77-
78-
PACKER_CMD="PACKER_LOG=1 packer build \
79-
-debug \
69+
PACKER_LOG=1 packer build \
8070
-on-error=${{ vars.PACKER_ON_ERROR }} \
8171
-only=${{ matrix.build }} \
8272
-var-file=$PKR_VAR_environment_root/${{ vars.CI_CLOUD }}.pkrvars.hcl \
83-
-var "source_image_name=${SOURCE_IMAGE_NAME}" \
84-
openstack.pkr.hcl"
85-
86-
# if [ "${{ github.event_name }}" != "schedule" ]; then
87-
# PACKER_CMD="$PACKER_CMD -var 'source_image_name[${{ matrix.os_version }}]=${SOURCE_IMAGE_NAME}'"
88-
# else
89-
# PACKER_CMD="$PACKER_CMD -var 'image_name=$IMAGE_NAME'"
90-
# fi
91-
92-
eval $PACKER_CMD
73+
openstack.pkr.hcl
9374
env:
9475
PKR_VAR_os_version: ${{ matrix.os_version }}
9576

‎packer/openstack.pkr.hcl

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ variable "volume_size" {
132132
type = map(number)
133133
default = {
134134
# fat image builds, GB:
135-
openhpc = 15
135+
openhpc-latest = 15
136136
openhpc-ofed = 15
137137
openhpc-cuda = 30
138138
}
@@ -153,9 +153,9 @@ variable "groups" {
153153
description = "Additional inventory groups (other than 'builder') to add build VM to, keyed by source name"
154154
default = {
155155
# fat image builds:
156-
openhpc = ["control", "compute", "login"]
157-
openhpc-ofed = ["control", "compute", "login", "ofed"]
158-
openhpc-cuda = ["control", "compute", "login", "ofed", "cuda"]
156+
openhpc-latest = ["ofed"]
157+
openhpc-ofed = ["control", "compute", "login"]
158+
openhpc-cuda = ["control", "compute", "login", "cuda"]
159159
}
160160
}
161161

@@ -191,9 +191,9 @@ source "openstack" "openhpc" {
191191

192192
build {
193193

194-
# non-OFED fat image:
194+
# latest fat image:
195195
source "source.openstack.openhpc" {
196-
name = "openhpc"
196+
name = "openhpc-latest"
197197
}
198198

199199
# OFED fat image:

0 commit comments

Comments
 (0)