Magnum capi

.github/workflows/enterprise-patching.yaml

@@ -0,0 +1,129 @@
+name: Patch and Retag Images
+
+on:
+  workflow_dispatch:
+  workflow_run:
+    workflows: ["Migrate Images to QUAY"]
+    types:
+      - completed
+    branches:
+      - main
+
+jobs:
+  generate-matrix:
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }}
+    outputs:
+      images: ${{ steps.generate-matrix.outputs.images }}
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Generate Matrix
+        id: generate-matrix
+        run: |
+          images=$(jq -r '.[]' .original-images.json | jq -R -s -c 'split("\n") | map(select(length > 0))')
+          echo "images=$images" >> $GITHUB_OUTPUT
+
+  patch-and-retag:
+    needs: generate-matrix
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        image: ${{ fromJson(needs.generate-matrix.outputs.images) }}
+      fail-fast: false
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker-container
+          driver-opts: |
+            image=moby/buildkit:master
+            network=host
+
+      - name: Install Copacetic
+        run: |
+          wget https://github.com/project-copacetic/copacetic/releases/download/v0.9.0/copa_0.9.0_linux_amd64.tar.gz
+          tar -xzf copa_0.9.0_linux_amd64.tar.gz
+          chmod +x copa
+          sudo mv copa /usr/local/bin/
+
+      - name: Install Trivy
+        run: |
+          TRIVY_VERSION="0.55.0"
+          wget https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
+          tar -xzf trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz
+          chmod +x trivy
+          sudo mv trivy /usr/local/bin/
+
+      - name: Login to Quay.io
+        uses: docker/login-action@v3
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_USER }}
+          password: ${{ secrets.QUAY_TOKEN }}
+
+      - name: Process Image
+        run: |
+          sudo apt-get update && sudo apt-get install -y jq python3-pip
+          image="${{ matrix.image }}"
+          echo "Processing $image"
+          base_name=$(echo "$image" | awk -F'/' '{print $NF}' | cut -d':' -f1)
+          tag=$(echo "$image" | awk -F':' '{print $NF}')
+          new_image="quay.io/rackspace/rackerlabs-${base_name}:${tag}"
+          patched_tag="${tag}-enterprise"
+          patched_image="quay.io/rackspace/rackerlabs-${base_name}:${patched_tag}"
+
+          # Pull the image
+          docker pull "$new_image" || { echo "Failed to pull $new_image"; exit 1; }
+
+          # Scan all vulnerabilities (OS and language-specific)
+          trivy image -f json -o "report-${base_name}-${tag}.json" "$new_image" || { echo "Failed to scan $new_image"; exit 1; }
+
+          # Scan OS vulnerabilities with fixes for Copacetic
+          trivy image --vuln-type os --ignore-unfixed -f json -o "os-report-${base_name}-${tag}.json" "$new_image" || { echo "Failed to scan OS vulnerabilities for $new_image"; exit 1; }
+
+          # Attempt to patch OS vulnerabilities; set intermediate image
+          if copa patch -i "$new_image" -r "os-report-${base_name}-${tag}.json" -t "$patched_tag"; then
+            echo "Patched OS vulnerabilities in $new_image"
+            intermediate_image="$patched_image"
+          else
+            echo "No OS vulnerabilities patched for $new_image"
+            intermediate_image="$new_image"
+          fi
+
+          # Filter cve/requirements.txt to only update installed packages
+          docker run --rm -v "$(pwd):/output" "$intermediate_image" sh -c "/var/lib/openstack/bin/pip3 list --format=json > /output/installed.json 2>/dev/null || echo '[]' > /output/installed.json"
+          python3 cve/filter.py
+
+          if [ -s "filtered-requirements.txt" ]; then
+            echo "Applying Python package updates from cve/requirements.txt"
+            echo "FROM $intermediate_image" > Dockerfile.temp
+            echo "COPY filtered-requirements.txt /tmp/filtered-requirements.txt" >> Dockerfile.temp
+            echo "RUN /var/lib/openstack/bin/pip3 install -r /tmp/filtered-requirements.txt" >> Dockerfile.temp
+            docker build -f Dockerfile.temp -t "$patched_image" . || { echo "Failed to build $patched_image with Python patches"; exit 1; }
+            intermediate_image="$patched_image"
+          else
+            echo "No Python packages updated from cve/requirements.txt"
+          fi
+
+          # Flatten the image
+          echo "Flattening $patched_image"
+          container_id=$(docker create "$intermediate_image")
+          docker export "$container_id" > "flattened-${base_name}-${patched_tag}.tar"
+          docker import "flattened-${base_name}-${patched_tag}.tar" "$patched_image"
+          docker rm "$container_id"
+          rm "flattened-${base_name}-${patched_tag}.tar"
+
+          # Push the flattened image
+          docker push "$patched_image" || { echo "Failed to push $patched_image"; exit 1; }
+          echo "Pushed $patched_image"
+
+          # Clean up
+          rm -f "report-${base_name}-${tag}.json" "os-report-${base_name}-${tag}.json" filtered-requirements.txt Dockerfile.temp installed.json requirements.txt
+
+env:
+  DOCKER_CLI_EXPERIMENTAL: enabled

.github/workflows/helm-argocd.yaml

@@ -0,0 +1,45 @@
+name: Helm GitHub Actions for argocd
+
+on:
+  pull_request:
+    paths:
+      - base-kustomize/argocd/**
+      - base-helm-configs/argocd/**
+      - .github/workflows/helm-argocd.yaml
+jobs:
+  helm:
+    strategy:
+      matrix:
+        overlays:
+          - base
+    name: Helm
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - uses: azure/setup-helm@v3
+        with:
+          version: latest
+          token: "${{ secrets.GITHUB_TOKEN }}"
+        id: helm
+      - name: Kubectl Install
+        working-directory: /usr/local/bin/
+        run: |
+            if [ ! -f /usr/local/bin/kubectl ]; then
+              curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
+              chmod +x ./kubectl
+            fi
+      - name: Run Helm Template
+        run: |
+          ${{ steps.helm.outputs.helm-path }} template argocd oci://registry-1.docker.io/bitnamicharts/argo-cd \
+            --namespace=argocd \
+            --wait \
+            --timeout 120m \
+            -f ${{ github.workspace }}/base-helm-configs/argocd/helm-argocd-overrides.yaml \
+            --post-renderer ${{ github.workspace }}/base-kustomize/kustomize.sh \
+            --post-renderer-args argocd/${{ matrix.overlays }} > /tmp/rendered.yaml
+      - name: Return helm Build
+        uses: actions/upload-artifact@v4
+        with:
+          name: helm-argocd-artifact-${{ matrix.overlays }}
+          path: /tmp/rendered.yaml

.github/workflows/helm-barbican.yaml

@@ -30,18 +30,13 @@ jobs:
               curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
               chmod +x ./kubectl
             fi
-      - name: Pull OSH submodules
+      - name: Pull OSH repositories
         run: |
-            git submodule update --init submodules/openstack-helm
-            git submodule update --init submodules/openstack-helm-infra
-      - name: Make OSH submodule
-        run: |
-            cd submodules/openstack-helm
-            make barbican
+          helm repo add openstack-helm https://tarballs.opendev.org/openstack/openstack-helm
+          helm repo update
       - name: Run Helm Template
         run: |
-          cd submodules/openstack-helm
-          ${{ steps.helm.outputs.helm-path }} template barbican ./barbican \
+          ${{ steps.helm.outputs.helm-path }} template barbican openstack-helm/barbican \
             --namespace=openstack \
             --wait \
             --timeout 120m \

.github/workflows/helm-cinder.yaml

@@ -30,18 +30,13 @@ jobs:
               curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
               chmod +x ./kubectl
             fi
-      - name: Pull OSH submodules
+      - name: Pull OSH repositories
         run: |
-            git submodule update --init submodules/openstack-helm
-            git submodule update --init submodules/openstack-helm-infra
-      - name: Make OSH submodule
-        run: |
-            cd submodules/openstack-helm
-            make cinder
+          helm repo add openstack-helm https://tarballs.opendev.org/openstack/openstack-helm
+          helm repo update
       - name: Run Helm Template
         run: |
-          cd submodules/openstack-helm
-          ${{ steps.helm.outputs.helm-path }} template cinder ./cinder \
+          ${{ steps.helm.outputs.helm-path }} template cinder openstack-helm/cinder \
             --namespace=openstack \
             --wait \
             --timeout 120m \

.github/workflows/helm-glance.yaml

@@ -30,18 +30,13 @@ jobs:
               curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
               chmod +x ./kubectl
             fi
-      - name: Pull OSH submodules
+      - name: Pull OSH repositories
         run: |
-            git submodule update --init submodules/openstack-helm
-            git submodule update --init submodules/openstack-helm-infra
-      - name: Make OSH submodule
-        run: |
-            cd submodules/openstack-helm
-            make glance
+          helm repo add openstack-helm https://tarballs.opendev.org/openstack/openstack-helm
+          helm repo update
       - name: Run Helm Template
         run: |
-          cd submodules/openstack-helm
-          ${{ steps.helm.outputs.helm-path }} template glance ./glance \
+          ${{ steps.helm.outputs.helm-path }} template glance openstack-helm/glance \
             --namespace=openstack \
             --wait \
             --timeout 120m \

.github/workflows/helm-heat.yaml

@@ -30,18 +30,13 @@ jobs:
               curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
               chmod +x ./kubectl
             fi
-      - name: Pull OSH submodules
+      - name: Pull OSH repositories
         run: |
-            git submodule update --init submodules/openstack-helm
-            git submodule update --init submodules/openstack-helm-infra
-      - name: Make OSH submodule
-        run: |
-            cd submodules/openstack-helm
-            make heat
+          helm repo add openstack-helm https://tarballs.opendev.org/openstack/openstack-helm
+          helm repo update
       - name: Run Helm Template
         run: |
-          cd submodules/openstack-helm
-          ${{ steps.helm.outputs.helm-path }} template heat ./heat \
+          ${{ steps.helm.outputs.helm-path }} template heat openstack-helm/heat \
             --namespace=openstack \
             --wait \
             --timeout 120m \

.github/workflows/helm-horizon.yaml

@@ -30,18 +30,13 @@ jobs:
               curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
               chmod +x ./kubectl
             fi
-      - name: Pull OSH submodules
+      - name: Pull OSH repositories
         run: |
-            git submodule update --init submodules/openstack-helm
-            git submodule update --init submodules/openstack-helm-infra
-      - name: Make OSH submodule
-        run: |
-            cd submodules/openstack-helm
-            make horizon
+          helm repo add openstack-helm https://tarballs.opendev.org/openstack/openstack-helm
+          helm repo update
       - name: Run Helm Template
         run: |
-          cd submodules/openstack-helm
-          ${{ steps.helm.outputs.helm-path }} template horizon ./horizon \
+          ${{ steps.helm.outputs.helm-path }} template horizon openstack-helm/horizon \
             --namespace=openstack \
             --wait \
             --timeout 120m \

.github/workflows/helm-keystone.yaml

@@ -30,18 +30,13 @@ jobs:
               curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
               chmod +x ./kubectl
             fi
-      - name: Pull OSH submodules
+      - name: Pull OSH repositories
         run: |
-            git submodule update --init submodules/openstack-helm
-            git submodule update --init submodules/openstack-helm-infra
-      - name: Make OSH submodule
-        run: |
-            cd submodules/openstack-helm
-            make keystone
+          helm repo add openstack-helm https://tarballs.opendev.org/openstack/openstack-helm
+          helm repo update
       - name: Run Helm Template
         run: |
-          cd submodules/openstack-helm
-          ${{ steps.helm.outputs.helm-path }} template keystone ./keystone \
+          ${{ steps.helm.outputs.helm-path }} template keystone openstack-helm/keystone \
             --namespace=openstack \
             --wait \
             --timeout 120m \

.github/workflows/helm-libvirt.yaml

@@ -28,18 +28,13 @@ jobs:
               curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
               chmod +x ./kubectl
             fi
-      - name: Pull OSH submodules
+      - name: Pull OSH repositories
         run: |
-            git submodule update --init submodules/openstack-helm
-            git submodule update --init submodules/openstack-helm-infra
-      - name: Make OSH submodule
-        run: |
-            cd submodules/openstack-helm-infra
-            make libvirt
+          helm repo add openstack-helm-infra https://tarballs.opendev.org/openstack/openstack-helm-infra
+          helm repo update
       - name: Run Helm Template
         run: |
-          cd submodules/openstack-helm-infra
-          ${{ steps.helm.outputs.helm-path }} template libvirt ./libvirt \
+          ${{ steps.helm.outputs.helm-path }} template libvirt openstack-helm-infra/libvirt \
             --namespace=openstack \
             --wait \
             --timeout 120m \

.github/workflows/helm-magnum.yaml

@@ -30,18 +30,13 @@ jobs:
               curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
               chmod +x ./kubectl
             fi
-      - name: Pull OSH submodules
+      - name: Pull OSH repositories
         run: |
-            git submodule update --init submodules/openstack-helm
-            git submodule update --init submodules/openstack-helm-infra
-      - name: Make OSH submodule
-        run: |
-            cd submodules/openstack-helm
-            make magnum
+          helm repo add openstack-helm https://tarballs.opendev.org/openstack/openstack-helm
+          helm repo update
       - name: Run Helm Template
         run: |
-          cd submodules/openstack-helm
-          ${{ steps.helm.outputs.helm-path }} template magnum ./magnum \
+          ${{ steps.helm.outputs.helm-path }} template magnum openstack-helm/magnum \
             --namespace=openstack \
             --wait \
             --timeout 120m \

.github/workflows/helm-neutron.yaml

@@ -30,18 +30,13 @@ jobs:
               curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
               chmod +x ./kubectl
             fi
-      - name: Pull OSH submodules
+      - name: Pull OSH repositories
         run: |
-            git submodule update --init submodules/openstack-helm
-            git submodule update --init submodules/openstack-helm-infra
-      - name: Make OSH submodule
-        run: |
-            cd submodules/openstack-helm
-            make neutron
+          helm repo add openstack-helm https://tarballs.opendev.org/openstack/openstack-helm
+          helm repo update
       - name: Run Helm Template
         run: |
-          cd submodules/openstack-helm
-          ${{ steps.helm.outputs.helm-path }} template neutron ./neutron \
+          ${{ steps.helm.outputs.helm-path }} template neutron openstack-helm/neutron \
             --namespace=openstack \
             --wait \
             --timeout 120m \