All published OPA images now run with a non-root uid/gid.
The uid:gid is set to 1000:1000 for all images. As a result
there is no longer a need for the --rootless image variant
hence it will not be published as part of future releases.
This change is in line with container security best practices.
OPA can still be run with root privileges by explicitly setting the user,
either with the --user argument for docker run, or by specifying
the securityContext in the Kubernetes Pod specification.
Fixes: #4295
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Buildx version >=0.10 generates a new OCI format
with support for provenance. As a result the
following error is generated on M1/M2 while inspecting
the manifest
> OCI manifest found, but accept header does not support OCI manifests
The suggested fix is to temporarily disable provenance.
Fixes: #5877
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Currently all OPA image variants except "rootless" use
uid/gid 0 (i.e. root). Per container security best
practices it is better to run as non-root. So now OPA
defaults to non-root uid/gid in images. If root user
if needed, it can be explicitly set.
The "rootless" image variant is no longer needed and
will be not published in future releases.
Also currently the debug variant is published
for `linux/amd64` platform. For `linux/arm64` only static
images are generated. The debug variant can be useful
for debugging purposes and hence this change adds that
to the static image which can then be used on amd64 and arm64 arch.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
New base images don't contain openssl and are sourced from
https://github.com/chainguard-images/images#chainguard-images.
I have also updated the static images to use their static base, though
it is not impacted by the openssl issue.
Remaining to do, perhaps as part of this PR is to update the debug
base images to something that doesn't contain openssl too. Currently
there is no cc image in the chainguard collection that contains a
busybox shell.
Signed-off-by: Charlie Egan <charlie@styra.com>
And enable the `tenv` linter for the future.
Also, bump version of golangci-lint and fix some new
warnings that came from that.
Signed-off-by: Anders Eknert <anders@eknert.com>
This is a bit of a bag of a few smaller things:
* workflows/nightly: skip imported gqlparser package.json
It is not used anywhere.
* .trivyignore: remove docker CVE
This has been bumped away when updating ORAS.
* website/livescripts: bump minimatch
This also updated the lockfile version... I think that's OK.
* workflows/pull-request: don't setup opa for docker image smoke test
* address netlify ignore script failure on large output
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
The incoming relative path is now converted as follows:
1. filepath.Abs: foo/bar -> c:\a\b\c\foo\bar
2. filepath.ToShasl: c:\a\b\c\foo\bar -> c:/a/b/c/foo/bar
3. prepend `file://`
That's something the runtime can make sense of, and the smoke test passes.
Fixes#5134.
Includes:
* ci: add smoke test with a bundle
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Two small moving parts less. The commit will now be included unabbreviated, but
I think that's OK.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This replaces the docker image so that we get one that has all of these
commands available: make, git, go, python2 and perl.
We can now run `make generate` in the steps used to generate the release patch,
so the release patch contains the builtin_metadata.json changes.
Before, we had been running `make generate` in the working directory, and
copied the file into the container's workdir; but that left the working
directory modified, and hindered patch application before cleaning up.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This is an attempt to fix an obscure condition that started last week:
the `aws s3 sync` command in our `deploy-ci` make target started failing,
with only this output:
<botocore.awsrequest.AWSRequest object at 0x7f3198832f70>
A promising google hit suggests that it's got to do with "what's the best
region for me?" auto-discovery failing. Passing any region should then do
the trick.
Ref: https://florian.ec/blog/github-actions-awscli-errors/
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* topdown: fix TestRego: run for all go versions, excluding the x509 error
That error has a different message on go1.16.
The previous attempt to exclude them from running caused _all tests_
to not be run.
* topdown_test/TestTopDownQueryCancellationEvery: up wait time for macos flakey tests
We've often seen this fail with "0 notes". Waiting for 10x the time
we previous waited for still seems to do the trick but should
hopefully remove the amount of failures we see in CE because of
slow macos runners.
* ci: don't run wasm build again in compat builds
The build is docker-based, and doesn't differ at all if run from a
different version of golang. So instead of re-building it in the
separate matrix jobs, we'll use the artifacts downloaded from the
artifact build job.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
With this change, the work done for local development, and the per-PR netlify preview changes:
It will no longer include the website stuff for versions other than edge, the current working tree.
We thus save us the time, and the flakiness, involved with
- checking if github has release binaries for all the versions
- checking out their sources
- fetching the release binaries to pre-hydrate old versions' live-blocks.
The previously-used, documented make target should still be intact.
Fixes#4379 to some extent, I hope.
* docs/website: remove "latest" binary from opa versions cache
Having a stale binary here -- one called "latest" but not actually
being "latest" -- causes issues like this: when building the website
content for the (real) latest version, the script would take the
old (previous-latest) binary, and fail because that binary didn't
know the latest future keywords.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* Makefile: temporary disable "delete" for edge bucket sync
This is a bandaid to be reverted when we've fixed the IAM policy
protecting the bucket to allow for deletions.
* workflow: re-enable token in checkout
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* build: don't push arm64 binaries to edge releases
They're not built for a release, but we'd still be publishing
them to the edge S3 bucket post-merge.
* build: silence 'aws s3 sync' output
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This change adds linux/arm64 binaries to the release. It also publishes an arm64
container image for all variants (standard, debug, rootless, static) and releases
(dev, edge, latest).
The build and push process uses buildx in order to push the individual
images by digest (i.e. untagged) and reference them in a single, tagged manifest
list. This avoids cluttering Docker Hub's tag list with `<tag>-<arch>` tags.
Fixes#2233
Signed-off-by: Nick Graef <1031317+ngraef@users.noreply.github.com>
Somewhat experimental, but now that pretty much all new macs
run with the ARM64 architecture it would be nice to add it as
a target to our releases. Since there is currently no runner
for GitHub Actions (https://github.com/actions/runner/issues/805)
we can't yet run the binary smoke test for this architecture,
but I'm tracking the issue and hoping that can be resolved soon.
Feel free to dismiss this if you think this should wait until later.
Signed-off-by: Anders Eknert <anders@eknert.com>
This commit improves the release-patch target to mention users in the
Miscellaneous section and warn if a GitHub token is not provided.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
* Do not run ci-release-tag target--the tests have already been run
pre-merge and post-merge so there is little reason to run them again
post-tag. The only thing this would do is find non-deterministic
test failures--which begs the question: what do we do with the
release? We already run tests pre-merge, post-merge, and nightly so
it's unlikely that post-tag will help improve quality.
* Use the RELEASE_DIR from the makefile for the `hub release` asset
parameter rather than assuming the TAG <=> RELEASE_DIR (this is not
always true if tagging an arbitrary commit.) This enables us to cut
release candidates without commiting changes to the repo.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This extra check is meant to catch go module proxy checksum mismatches,
like the one we've released 0.32.1 to fix, earlier.
It causes the go mod tooling to fetch all modules from their external sources,
most likely all github references, and compares the contents' checksums with
what we have in go.sum. It deliberately bypasses the "sumdb" service that is
part of the golang infrastructure.
The event of a mismatch would happen if a git tag was published, and later
changed, and the golang infrastructure's module proxy (and sumdb service)
had picked up the first tag. This is rather unlikely, and this test is thus a bit
over-cautious. The idea is that if it becomes invisible, it's fine to keep, and
gives us a bit of extra safety. However, if it becomes annoying (it's a giant
network dependency in our CI runs), it's not critical enough to be kept and
is OK to disable again.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
We only check the build, not the tests.
And we only check the latest release of the 1.15 and 1.16 series.
since 1.17 is what we build and test with anyways.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This way `make` does not bomb out if docker not installed/running. This
is similar to what we do for the wasm library build.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This means that "make lint" will work the same for everyone and the
workflow without additional coordination. Before this PR, it was
possible for maintainers to be on a different version of golangci-lint
than the one used by the GitHub workflow and so "make check" would
provide inconsistent results.
Also add timeout to configuration so we don't time out.`
Signed-off-by: Will Beason <willbeason@google.com>
* build: add static (wasm-disabled) linux build
Fixes#3499.
Also:
* build: deprecate 'release' and 'release-local' targets that aren't used in
our build anymore, and will go away eventually.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Ashutosh Narkar