Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: allow customers to define the trusted QEMU images #519

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+16 −13
Open

fix: allow customers to define the trusted QEMU images #519

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
de4909b
update helm chart
scme0 Nov 7, 2024
f380116
docs changes
scme0 Nov 8, 2024
e6405b1
fix tests
scme0 Nov 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 2 additions & 6 deletions charts/cf-runtime/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
apiVersion: v2
description: A Helm chart for Codefresh Runner
name: cf-runtime
version: 7.0.0
version: 7.0.1
keywords:
- codefresh
- runner
Expand All @@ -17,12 +17,8 @@ annotations:
artifacthub.io/containsSecurityUpdates: "false"
# Supported kinds: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`:
artifacthub.io/changes: |
- kind: changed
description: "BREAKING: adding images digests"
- kind: fixed
description: "fix of variable replacement in arguments of typed steps (Engine 1.174.14)"
- kind: fixed
description: "fix of debugger timeout (Engine 1.174.15)"
description: "Allow on-prem customers to define which QEMU images are trusted for docker buildx builds"
dependencies:
- name: cf-common
repository: oci://quay.io/codefresh/charts
Expand Down
8 changes: 5 additions & 3 deletions charts/cf-runtime/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -479,9 +479,9 @@ runtime:
image:
registry: quay.io
repository: codefresh/engine
tag: 1.174.15
tag: 1.174.16
pullPolicy: IfNotPresent
digest: sha256:d547c2044c1488e911ff726462cc417adf2dda731cafd736493c4de4eb9e357b
digest: sha256:3a2aa375466bc3c5bf85f7e1d29cee35ac6fae32c2c19d770caad33f448856cc
# -- Set container command.
command:
- npm
Expand All @@ -502,7 +502,7 @@ runtime:
runtimeImages:
COMPOSE_IMAGE: quay.io/codefresh/compose:v2.28.1-1.5.0@sha256:362977564c096b7c2c007b8478ec87cac13d781839adc271d858290213bd89f2
CONTAINER_LOGGER_IMAGE: quay.io/codefresh/cf-container-logger:1.11.7@sha256:1e7bcee65203f9fdfc7ee5231cb4d29b179479d70dd42ec9855d20c57ab43c48
DOCKER_BUILDER_IMAGE: quay.io/codefresh/cf-docker-builder:1.3.14@sha256:e61f0694fb7477244014be971a0bad724242e4fdefe810f38e58990d7db6bdc5
DOCKER_BUILDER_IMAGE: quay.io/codefresh/cf-docker-builder:1.3.16@sha256:142288b34c4af9abad44f304f00b109825df0894853a66a77a09f3ebf507d176
DOCKER_PULLER_IMAGE: quay.io/codefresh/cf-docker-puller:8.0.18@sha256:1a15c3ae0952d3986de7866a3def8ac7e3e39f668fe87fd46c63d886ca06c6d7
DOCKER_PUSHER_IMAGE: quay.io/codefresh/cf-docker-pusher:6.0.16@sha256:05efc1af8b1196f1b9b3f0781b4dcc1aa2cdd0ffc1347ee5fa81b16d029ec5c2
DOCKER_TAG_PUSHER_IMAGE: quay.io/codefresh/cf-docker-tag-pusher:1.3.14@sha256:801caf9100218c9ed638fb5ca205fcc133f54d00468ed81093b22a4f0a0ffae9
Expand Down Expand Up @@ -536,6 +536,8 @@ runtime:
METRICS_PROMETHEUS_HOST: '0.0.0.0'
# -- Port for Prometheus metrics server
METRICS_PROMETHEUS_PORT: 9100
# -- Trusted QEMU images used for docker builds - when left blank only 'tonistiigi/binfmt' is trusted.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wouldn't it be better to just put tonistiigi/binfmt as default value here?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe. Are there other ways that the runtime can be deployed? I mean instead of using helm? In those cases removing the hard-coded default from the code and putting it here as a default instead would be a breaking change. And I didn't want to set the default here leading people to assume that if they set it to empty, that it would effectively stop the default from being accepted.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not aware of any other way. As an operator I prefer explicit configs over some source code magic. And as a safeguard I'm believer in "it's better to crash that produce unexpected result", so just fail pre-flight check on startup in case someone managed to launch it with empty list.

But that's just my opinion, waiting for someone else to chime in.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a fair opinion and I tend to agree with you. I had a bit of a closer look and it seems as though there are still customers using the CLI to install their runners in which case removing the default from the code would be a breaking change unless I also update the CLI to provide the default. In this case I think to make things easier I'll keep it as is and once the CLI is no longer used we can tidy this up.

TRUSTED_QEMU_IMAGES: ''
# -- Set workflow limits.
workflowLimits:
# -- Maximum time allowed to the engine to wait for the pre-steps (aka "Initializing Process") to succeed; seconds.
Expand Down
Loading