Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixed OPAL Cedar Client build CI #628

Merged
merged 4 commits into from
Jul 23, 2024
Merged

Fixed OPAL Cedar Client build CI #628

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5f01375
Fixed OPAL Cedar Client build CI
danyi1212 Jul 22, 2024
6ae6b18
Updated rust version for OPAL Cedar Client docker
danyi1212 Jul 22, 2024
63c27c8
Fixed docker warnings
danyi1212 Jul 22, 2024
ed70c74
Fixed cedar build
danyi1212 Jul 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 17 additions & 21 deletions .github/workflows/on_release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,43 +109,26 @@ jobs:
# pushes the *same* docker images that were previously tested as part of e2e sanity test.
# each image is pushed with the versioned tag first, if it succeeds the image is pushed with the latest tag as well.
- name: Build & Push client
if: ${{ !(github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'true') }}
id: build_push_client
uses: docker/build-push-action@v4
with:
file: docker/Dockerfile
platforms: linux/amd64,linux/arm64
push: true
push: ${{ !(github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'true') }}
target: client
cache-from: type=registry,ref=permitio/opal-client:latest
cache-to: type=inline
tags: |
permitio/opal-client:latest
permitio/opal-client:${{ env.opal_version_tag }}

# - name: Build & Push client cedar
# if: ${{ !(github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'true') }}
# id: build_push_client_cedar
# uses: docker/build-push-action@v4
# with:
# file: docker/Dockerfile
# platforms: linux/amd64,linux/arm64
# push: true
# target: client-cedar
# cache-from: type=registry,ref=permitio/opal-client-cedar:latest
# cache-to: type=inline
# tags: |
# permitio/opal-client-cedar:latest
# permitio/opal-client-cedar:${{ env.opal_version_tag }}

- name: Build client-standalone
if: ${{ !(github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'true') }}
id: build_push_client_standalone
uses: docker/build-push-action@v4
with:
file: docker/Dockerfile
platforms: linux/amd64,linux/arm64
push: true
push: ${{ !(github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'true') }}
target: client-standalone
cache-from: type=registry,ref=permitio/opal-client-standalone:latest
cache-to: type=inline
Expand All @@ -154,16 +137,29 @@ jobs:
permitio/opal-client-standalone:${{ env.opal_version_tag }}

- name: Build server
if: ${{ !(github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'true') }}
id: build_push_server
uses: docker/build-push-action@v4
with:
file: docker/Dockerfile
platforms: linux/amd64,linux/arm64
push: true
push: ${{ !(github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'true') }}
target: server
cache-from: type=registry,ref=permitio/opal-server:latest
cache-to: type=inline
tags: |
permitio/opal-server:latest
permitio/opal-server:${{ env.opal_version_tag }}

- name: Build & Push client cedar
id: build_push_client_cedar
uses: docker/build-push-action@v4
with:
file: docker/Dockerfile
platforms: linux/amd64,linux/arm64
push: ${{ !(github.event_name == 'workflow_dispatch' && github.event.inputs.dry_run == 'true') }}
target: client-cedar
cache-from: type=registry,ref=permitio/opal-client-cedar:latest
cache-to: type=inline
tags: |
permitio/opal-client-cedar:latest
permitio/opal-client-cedar:${{ env.opal_version_tag }}
2 changes: 1 addition & 1 deletion cedar-agent
Open in desktop
Submodule cedar-agent updated 35 files
+685 −848 Cargo.lock
+6 −6 Cargo.toml
+6 −2 Dockerfile
+43 −9 README.md
+5 −50 examples/data.json
+84 −0 examples/schema.json
+1 −1 src/authn.rs
+63 −0 src/common.rs
+30 −2 src/config.rs
+23 −4 src/main.rs
+17 −5 src/routes/authorization.rs
+5 −2 src/routes/data.rs
+1 −0 src/routes/mod.rs
+34 −7 src/routes/policies.rs
+70 −0 src/routes/schema.rs
+91 −9 src/schemas/authorization.rs
+11 −12 src/schemas/data.rs
+1 −0 src/schemas/mod.rs
+32 −0 src/schemas/schema.rs
+102 −0 src/services/data/load_from_file.rs
+3 −1 src/services/data/memory.rs
+3 −0 src/services/data/mod.rs
+3 −0 src/services/mod.rs
+6 −0 src/services/policies/errors.rs
+101 −0 src/services/policies/load_from_file.rs
+50 −6 src/services/policies/memory.rs
+13 −3 src/services/policies/mod.rs
+84 −0 src/services/schema/load_from_file.rs
+100 −0 src/services/schema/memory.rs
+20 −0 src/services/schema/mod.rs
+227 −3 tests/services/data_tests.rs
+1 −0 tests/services/mod.rs
+18 −6 tests/services/policies_tests.rs
+81 −0 tests/services/schema_tests.rs
+158 −48 tests/services/utils.rs
30 changes: 14 additions & 16 deletions docker/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# BUILD STAGE ---------------------------------------
# split this stage to save time and reduce image size
# ---------------------------------------------------
FROM python:3.10-bookworm as BuildStage
FROM python:3.10-bookworm AS build-stage
# from now on, work in the /app directory
WORKDIR /app/
# Layer dependency install (for caching)
Expand All @@ -15,19 +15,17 @@ RUN pip install --no-cache-dir --upgrade pip && pip install --no-cache-dir -r ./
# CEDAR AGENT BUILD STAGE ---------------------------
# split this stage to save time and reduce image size
# ---------------------------------------------------
FROM rust:1.69.0 as cedar-builder
COPY cedar-agent /tmp/cedar-agent/
ARG cargo_flags="-r"
RUN cd /tmp/cedar-agent && \
cargo build ${cargo_flags} && \
cp /tmp/cedar-agent/target/*/cedar-agent /
FROM rust:1.79 AS cedar-builder
COPY ./cedar-agent /tmp/cedar-agent
WORKDIR /tmp/cedar-agent
RUN CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse cargo build --release

# COMMON IMAGE --------------------------------------
# ---------------------------------------------------
FROM python:3.10-slim-bookworm as common
FROM python:3.10-slim-bookworm AS common

# copy libraries from build stage (This won't copy redundant libraries we used in BuildStage)
COPY --from=BuildStage /usr/local /usr/local
# copy libraries from build stage (This won't copy redundant libraries we used in build-stage)
COPY --from=build-stage /usr/local /usr/local

# Add non-root user (with home dir at /opal)
RUN useradd -m -b / -s /bin/bash opal
Expand Down Expand Up @@ -61,7 +59,7 @@ CMD ["./start.sh"]

# STANDALONE IMAGE ----------------------------------
# ---------------------------------------------------
FROM common as client-standalone
FROM common AS client-standalone
# uvicorn config ------------------------------------
# install the opal-client package
RUN cd ./packages/opal-client && python setup.py install
Expand All @@ -88,7 +86,7 @@ VOLUME /opal/backup

# IMAGE to extract OPA from official image ----------
# ---------------------------------------------------
FROM alpine:latest as opa-extractor
FROM alpine:latest AS opa-extractor
USER root

RUN apk update && apk add skopeo tar
Expand All @@ -106,7 +104,7 @@ RUN skopeo copy "docker://${opa_image}:${opa_tag}" docker-archive:./image.tar &&
# OPA CLIENT IMAGE ----------------------------------
# Using standalone image as base --------------------
# ---------------------------------------------------
FROM client-standalone as client
FROM client-standalone AS client

# Temporarily move back to root for additional setup
USER root
Expand All @@ -123,13 +121,13 @@ USER opal
# CEDAR CLIENT IMAGE --------------------------------
# Using standalone image as base --------------------
# ---------------------------------------------------
FROM client-standalone as client-cedar
FROM client-standalone AS client-cedar

# Temporarily move back to root for additional setup
USER root

# Copy cedar from its build stage
COPY --from=cedar-builder /cedar-agent /bin/cedar-agent
COPY --from=cedar-builder /tmp/cedar-agent/target/*/cedar-agent /bin/cedar-agent

# enable inline Cedar agent
ENV OPAL_POLICY_STORE_TYPE=CEDAR
Expand All @@ -142,7 +140,7 @@ USER opal

# SERVER IMAGE --------------------------------------
# ---------------------------------------------------
FROM common as server
FROM common AS server

RUN apt-get update && apt-get install -y openssh-client git && apt-get clean

Expand Down
Loading