-
Notifications
You must be signed in to change notification settings - Fork 3.4k
Increase usability of Makefile.override #32660
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
/test |
3e1a28d
to
d5265f6
Compare
d5265f6
to
78ae62d
Compare
To test the changes to the ci images workflow, I created a patch that added a Here's the link to the successful run: https://github.com/cilium/cilium/actions/runs/9194660121?pr=32660 diff --git a/.github/workflows/build-images-ci.yaml b/.github/workflows/build-images-ci.yaml
index 67287bb256..a1fdaea5a9 100644
--- a/.github/workflows/build-images-ci.yaml
+++ b/.github/workflows/build-images-ci.yaml
@@ -11,6 +11,7 @@ on:
branches:
- main
- ft/main/**
+ pull_request:
# If the cache was cleaned we should re-build the cache with the latest commit
workflow_run:
@@ -140,7 +141,7 @@ jobs:
# main branch pushes
- name: CI Build ${{ matrix.name }}
- if: ${{ github.event_name != 'pull_request_target' && !startsWith(github.ref_name, 'ft/') }}
+ if: ${{ github.event_name != 'pull_request' && !startsWith(github.ref_name, 'ft/') }}
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
id: docker_build_ci
with:
@@ -160,7 +161,7 @@ jobs:
OPERATOR_VARIANT=${{ matrix.name }}
- name: CI race detection Build ${{ matrix.name }}
- if: ${{ github.event_name != 'pull_request_target' && !startsWith(github.ref_name, 'ft/') }}
+ if: ${{ github.event_name != 'pull_request' && !startsWith(github.ref_name, 'ft/') }}
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
id: docker_build_ci_detect_race_condition
with:
@@ -182,7 +183,7 @@ jobs:
OPERATOR_VARIANT=${{ matrix.name }}
- name: CI Unstripped Binaries Build ${{ matrix.name }}
- if: ${{ github.event_name != 'pull_request_target' && !startsWith(github.ref_name, 'ft/') }}
+ if: ${{ github.event_name != 'pull_request' && !startsWith(github.ref_name, 'ft/') }}
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
id: docker_build_ci_unstripped
with:
@@ -292,7 +293,7 @@ jobs:
# PR or feature branch updates
- name: CI Build ${{ matrix.name }}
- if: ${{ github.event_name == 'pull_request_target' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
+ if: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
id: docker_build_ci_pr
with:
@@ -308,7 +309,7 @@ jobs:
OPERATOR_VARIANT=${{ matrix.name }}
- name: CI race detection Build ${{ matrix.name }}
- if: ${{ github.event_name == 'pull_request_target' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
+ if: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
id: docker_build_ci_pr_detect_race_condition
with:
@@ -326,7 +327,7 @@ jobs:
OPERATOR_VARIANT=${{ matrix.name }}
- name: CI Unstripped Binaries Build ${{ matrix.name }}
- if: ${{ github.event_name == 'pull_request_target' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
+ if: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
id: docker_build_ci_pr_unstripped
with:
@@ -343,14 +344,14 @@ jobs:
OPERATOR_VARIANT=${{ matrix.name }}
- name: Sign Container Images
- if: ${{ github.event_name == 'pull_request_target' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
+ if: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
run: |
cosign sign -y quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/${{ matrix.name }}-ci@${{ steps.docker_build_ci_pr.outputs.digest }}
cosign sign -y quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/${{ matrix.name }}-ci@${{ steps.docker_build_ci_pr_detect_race_condition.outputs.digest }}
cosign sign -y quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/${{ matrix.name }}-ci@${{ steps.docker_build_ci_pr_unstripped.outputs.digest }}
- name: Generate SBOM
- if: ${{ github.event_name == 'pull_request_target' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
+ if: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
uses: anchore/sbom-action@7ccf588e3cf3cc2611714c2eeae48550fbc17552 # v0.15.11
with:
artifact-name: sbom_ci_pr_${{ matrix.name }}_${{ steps.tag.outputs.tag }}.spdx.json
@@ -358,7 +359,7 @@ jobs:
image: quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/${{ matrix.name }}-ci:${{ steps.tag.outputs.tag }}
- name: Generate SBOM (race)
- if: ${{ github.event_name == 'pull_request_target' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
+ if: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
uses: anchore/sbom-action@7ccf588e3cf3cc2611714c2eeae48550fbc17552 # v0.15.11
with:
artifact-name: sbom_ci_pr_race_${{ matrix.name }}_${{ steps.tag.outputs.tag }}.spdx.json
@@ -366,7 +367,7 @@ jobs:
image: quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/${{ matrix.name }}-ci:${{ steps.tag.outputs.tag }}-race
- name: Generate SBOM (unstripped)
- if: ${{ github.event_name == 'pull_request_target' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
+ if: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
uses: anchore/sbom-action@7ccf588e3cf3cc2611714c2eeae48550fbc17552 # v0.15.11
with:
artifact-name: sbom_ci_pr_unstripped_${{ matrix.name }}_${{ steps.tag.outputs.tag }}.spdx.json
@@ -374,14 +375,14 @@ jobs:
image: quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/${{ matrix.name }}-ci:${{ steps.tag.outputs.tag }}-unstripped
- name: Attach SBOM to Container Images
- if: ${{ github.event_name == 'pull_request_target' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
+ if: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
run: |
cosign attach sbom --sbom sbom_ci_pr_${{ matrix.name }}_${{ steps.tag.outputs.tag }}.spdx.json quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/${{ matrix.name }}-ci@${{ steps.docker_build_ci_pr.outputs.digest }}
cosign attach sbom --sbom sbom_ci_pr_race_${{ matrix.name }}_${{ steps.tag.outputs.tag }}.spdx.json quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/${{ matrix.name }}-ci@${{ steps.docker_build_ci_pr_detect_race_condition.outputs.digest }}
cosign attach sbom --sbom sbom_ci_pr_unstripped_${{ matrix.name }}_${{ steps.tag.outputs.tag }}.spdx.json quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/${{ matrix.name }}-ci@${{ steps.docker_build_ci_pr_unstripped.outputs.digest }}
- name: Sign SBOM Images
- if: ${{ github.event_name == 'pull_request_target' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
+ if: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
run: |
docker_build_ci_pr_digest="${{ steps.docker_build_ci_pr.outputs.digest }}"
image_name="quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/${{ matrix.name }}-ci:${docker_build_ci_pr_digest/:/-}.sbom"
@@ -399,7 +400,7 @@ jobs:
cosign sign -y "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/${{ matrix.name }}-ci@${docker_build_ci_pr_unstripped_sbom_digest}"
- name: CI Image Releases digests
- if: ${{ github.event_name == 'pull_request_target' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
+ if: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && startsWith(github.ref_name, 'ft/')) }}
shell: bash
run: |
mkdir -p image-digest/
@@ -417,7 +418,7 @@ jobs:
# Store docker's golang's cache build locally only on the main branch
- name: Store ${{ matrix.name }} Golang cache build locally
- if: ${{ github.event_name != 'pull_request_target' && steps.cache.outputs.cache-hit != 'true' && github.ref_name == github.event.repository.default_branch }}
+ if: ${{ github.event_name != 'pull_request' && steps.cache.outputs.cache-hit != 'true' && github.ref_name == github.event.repository.default_branch }}
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
with:
provenance: false
@@ -430,7 +431,7 @@ jobs:
# Store docker's golang's cache build locally only on the main branch
- name: Store ${{ matrix.name }} Golang cache in GitHub cache path
- if: ${{ github.event_name != 'pull_request_target' && steps.cache.outputs.cache-hit != 'true' && github.ref_name == github.event.repository.default_branch }}
+ if: ${{ github.event_name != 'pull_request' && steps.cache.outputs.cache-hit != 'true' && github.ref_name == github.event.repository.default_branch }}
shell: bash
run: |
mkdir -p /tmp/.cache/${{ matrix.name }}/ |
78ae62d
to
8c11dea
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hubble Relay build changes LGTM
8c11dea
to
26d4481
Compare
This commit replaces the NOSTRIP, NOOPT, LOCKDEBUG, RACE, V and LIBNETWORK_PLUGIN docker build args with a single, generic build arg named "MODIFIERS". This allows for arbitrary flags to be passed to make when building a docker image as well as removes the need for modifications to dockerfiles when a new build-time modifier is added. One example use case is using `Makefile.overrides` to define a new flag that can be passed to make when building docker images. The new flag could enable appending values to the MODIFIERS build argument, which would allow the propagation of configuration variables down to make invocations used to build binaries within a Dockerfile. Signed-off-by: Ryan Drew <ryan.drew@isovalent.com>
This commit adds a new environment variable to the docker-specific aspects of the Cilium Makefiles named `ADDITIONAL_MODIFIERS`. This environment variable can be used to modify the `MODIFIERS` docker build arg, adding in any extra values that haven't previously been specified via a preset, such as `RACE` or `NOSTRIP`. Signed-off-by: Ryan Drew <ryan.drew@isovalent.com>
make: Add include to Makefile.override in binary Makefiles This commit adds an include statement for Makefile.override in Makefiles specific to building Cilium's go binaries. Makefile.override is included in the top-level Makefile as a method for optionally overriding variables, however it is not included in any of these binary-specific Makefiles. This means that the ability to override variables is only available for targets in the top-level Makefile, preventing use cases where overriding variables used in these binary-specific Makefiles can be useful. As an example, this commit would allow one to override the GO variable to specify a specific go binary to use in order to build a target. Signed-off-by: Ryan Drew <ryan.drew@isovalent.com>
26d4481
to
22ecbd6
Compare
/test |
Rebased and ran a test commit to check for accuracy. Here's the passing run: https://github.com/cilium/cilium/actions/runs/9451756541?pr=32660. |
22ecbd6
to
07f5c0b
Compare
/test |
ARG NOSTRIP | ||
ARG NOOPT | ||
ARG LOCKDEBUG | ||
ARG RACE | ||
# OPERATOR_VARIANT determines the target cloud provider to build the operator for. | ||
ARG OPERATOR_VARIANT | ||
# MODIFIERS are extra arguments to be passed to make at build time. | ||
ARG MODIFIERS |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@learnitall The changes here are not reflected in the make
call below. I assume that this would need to be fixed, right?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yep, thank you for opening a fix.
In PR cilium#32660, the MODIFIERS build argument was added as a replacement for individual build arguments, one of which was NOSTRIP. There was an uncaught usage of NOSTRIP in cilium's Dockerfile, which has caused the NOSTRIP modifier to become a no-op. This commit fixes this usage, allowing for NOSTRIP to be used again. Signed-off-by: Ryan Drew <ryan.drew@isovalent.com>
In PR #32660, the MODIFIERS build argument was added as a replacement for individual build arguments, one of which was NOSTRIP. There was an uncaught usage of NOSTRIP in cilium's Dockerfile, which has caused the NOSTRIP modifier to become a no-op. This commit fixes this usage, allowing for NOSTRIP to be used again. Signed-off-by: Ryan Drew <ryan.drew@isovalent.com>
Please ensure your pull request adheres to the following guidelines:
description and a
Fixes: #XXX
line if the commit addresses a particularGitHub issue.
Fixes: <commit-id>
tag, thenplease add the commit author[s] as reviewer[s] to this issue.
The goal of this PR is to make two slight adjustments to the way modifier flags, such as
RACE
,NOSTRIP
andLOCKDEBUG
, are handled, to increase the usability ofMakefile.override
in adjusting the build process for binaries and Docker images.Currently, each 'modifier' that can be applied at build time is set through its own build argument within Makefiles and Docker images. For example, here is the flow for the
NOSTRIP
flag:NOSTRIP=1
on the command line when invokingmake
.docker-images-all
, the docker build argument namedNOSTRIP
is set to1
. This build argument is used to pass through theNOSTRIP
flag to make invocations within the Dockerfile. See Makefile.docker and an example DockerfileNOSTRIP
flag is checked withinMakefile.defs
to determine if the-s
and-w
flags should be passed togo build
via theGO_BUILD
Makefile-level variable. WhenNOSTRIP
contains some value, these flags are omitted. See Makefile.defs.This process has a couple of limitations. First, each logical modifier that can be applied at build time requires its own docker build argument. This increases the number of layers in the produced docker image and the number of changes required to be made and backported to the image's Dockerfile. Second, the requirement for hardcoding a build argument for each modifier makes any additional build modification a user wants to add require changes within each target Dockerfile, each target binary's Makefile and within
Makefile.docker
.This PR introduces the following changes to address this use case:
MODIFIERS
build arg, which is set withinMakefile.docker
. Existing modifiers are set automatically, with additional modifiers able to be passed in via an environment variable namedADDITIONAL_MODIFIERS
. Existing modifiers, and new modifiers that are added to the tree, should be made available as environment variables to help ease documentation.Makefile.override
was added within each binary's Makefile after the include ofMakefile.defs
. This allows for modifications to variables set withinMakefile.defs
through the use ofMakefile.override
.Makefile.override
will have access to the flags that a user specifies withADDITIONAL_MODIFIERS
.Here's an example of how this could be used. Say I'm a user with a fork of Cilium and I'm maintaining a new feature that needs to be enabled via a build tag named
mycoolfeature
. With the changes in this PR, this build flag can be toggled via an environment variable namedMYCOOLFEATURE
with the followingMakefile.override
:I could now build each Cilium docker image with my build tag with the following make invocation:
Before this PR, the following changes would be needed: