Skip to content

[VC-45081] Automate the release process for cyberark-disco-agent #725

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 19, 2025
Merged

[VC-45081] Automate the release process for cyberark-disco-agent #725

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Copy link
Member Author

@wallrj-cyberark wallrj-cyberark Sep 19, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test release:

$ export VERSION=v1.7.0-alpha.1
git tag --annotate --message="Release ${VERSION}" "${VERSION}"
git push origin "${VERSION}"
Enumerating objects: 1, done.
Counting objects: 100% (1/1), done.
Writing objects: 100% (1/1), 175 bytes | 175.00 KiB/s, done.
Total 1 (delta 0), reused 0 (delta 0), pack-reused 0 (from 0)
To github.com:jetstack/jetstack-secure.git
 * [new tag]         v1.7.0-alpha.1 -> v1.7.0-alpha.1

Original file line number Diff line number Diff line change
Expand Up @@ -37,13 +37,19 @@ jobs:
go-version: ${{ steps.go-version.outputs.result }}

- id: release
run: make release
run: make release ark-release

outputs:
RELEASE_OCI_PREFLIGHT_IMAGE: ${{ steps.release.outputs.RELEASE_OCI_PREFLIGHT_IMAGE }}
RELEASE_OCI_PREFLIGHT_TAG: ${{ steps.release.outputs.RELEASE_OCI_PREFLIGHT_TAG }}
RELEASE_HELM_CHART_IMAGE: ${{ steps.release.outputs.RELEASE_HELM_CHART_IMAGE }}
RELEASE_HELM_CHART_VERSION: ${{ steps.release.outputs.RELEASE_HELM_CHART_VERSION }}
ARK_IMAGE: ${{ steps.release.outputs.ARK_IMAGE }}
ARK_IMAGE_TAG: ${{ steps.release.outputs.ARK_IMAGE_TAG }}
ARK_IMAGE_DIGEST: ${{ steps.release.outputs.ARK_IMAGE_DIGEST }}
ARK_CHART: ${{ steps.release.outputs.ARK_CHART }}
ARK_CHART_TAG: ${{ steps.release.outputs.ARK_CHART_TAG }}
ARK_CHART_DIGEST: ${{ steps.release.outputs.ARK_CHART_DIGEST }}

github_release:
runs-on: ubuntu-latest
Expand All @@ -61,6 +67,12 @@ jobs:
echo "OCI_PREFLIGHT_TAG: ${{ needs.build_and_push.outputs.RELEASE_OCI_PREFLIGHT_TAG }}" >> .notes-file
echo "HELM_CHART_IMAGE: ${{ needs.build_and_push.outputs.RELEASE_HELM_CHART_IMAGE }}" >> .notes-file
echo "HELM_CHART_VERSION: ${{ needs.build_and_push.outputs.RELEASE_HELM_CHART_VERSION }}" >> .notes-file
echo "ARK_IMAGE: ${{ needs.build_and_push.outputs.ARK_IMAGE }}" >> .notes-file
echo "ARK_IMAGE_TAG: ${{ needs.build_and_push.outputs.ARK_IMAGE_TAG }}" >> .notes-file
echo "ARK_IMAGE_DIGEST: ${{ needs.build_and_push.outputs.ARK_IMAGE_DIGEST }}" >> .notes-file
echo "ARK_CHART: ${{ needs.build_and_push.outputs.ARK_CHART }}" >> .notes-file
echo "ARK_CHART_TAG: ${{ needs.build_and_push.outputs.ARK_CHART_TAG }}" >> .notes-file
echo "ARK_CHART_DIGEST: ${{ needs.build_and_push.outputs.ARK_CHART_DIGEST }}" >> .notes-file

- env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Expand Down
19 changes: 13 additions & 6 deletions RELEASE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,11 @@ The release process is semi-automated.
> [!NOTE]
>
> Upon pushing the tag, a GitHub Action will do the following:
> - Build and publish the container image at `quay.io/jetstack/venafi-agent`,
> - Build and publish the Helm chart at `oci://quay.io/jetstack/charts/venafi-kubernetes-agent`,
> - Build and publish the container image: `quay.io/jetstack/venafi-agent`,
> - Build and publish the Helm chart: `oci://quay.io/jetstack/charts/venafi-kubernetes-agent`,
> - Build and publish the container image: `quay.io/jetstack/cyberark-disco-agent`,
> - Build and publish the Helm chart: `oci://quay.io/jetstack/charts/cyberark-disco-agent`,
> - Create a draft GitHub release,
> - Upload the Helm chart tarball to the GitHub release.
Copy link
Member Author

@wallrj-cyberark wallrj-cyberark Sep 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was changed some time after the 1.4.0 release. Newer releases push the helm chart directly to quay.io


1. Upgrade the Go dependencies.

Expand Down Expand Up @@ -71,18 +72,20 @@ The release process is semi-automated.

For context, the new tag will create the following images:

| Image | Automation |
| --------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| Image | Automation |
|-----------------------------------------------------------|----------------------------------------------------------------------------------------------|
| `quay.io/jetstack/venafi-agent` | Automatically built by the [release action](.github/workflows/release.yml) on Git tag pushes |
| `quay.io/jetstack/cyberark-disco-agent` | Automatically built by the [release action](.github/workflows/release.yml) on Git tag pushes |
| `registry.venafi.cloud/venafi-agent/venafi-agent` | Automatically mirrored by Harbor Replication rule |
| `private-registry.venafi.cloud/venafi-agent/venafi-agent` | Automatically mirrored by Harbor Replication rule |
| `private-registry.venafi.eu/venafi-agent/venafi-agent` | Automatically mirrored by Harbor Replication rule |

and the following OCI Helm charts:

| Helm Chart | Automation |
| -------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
|----------------------------------------------------------------------|----------------------------------------------------------------------------------------------|
| `oci://quay.io/jetstack/charts/venafi-kubernetes-agent` | Automatically built by the [release action](.github/workflows/release.yml) on Git tag pushes |
| `oci://quay.io/jetstack/charts/cyberark-disco-agent` | Automatically built by the [release action](.github/workflows/release.yml) on Git tag pushes |
Copy link
Member

@maelvls maelvls Sep 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why do we push to quay.io? Eventually, customers will be pulling from

registry.venafi.cloud/public/venafi-images/cyberark-disco-agent

so why not push to Harbor directly?

Copy link
Member Author

@wallrj-cyberark wallrj-cyberark Sep 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't have permission, do I?

Copy link
Member Author

@wallrj-cyberark wallrj-cyberark Sep 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And also for consistency with the existing agent release process. I can change the release process in future to push all artifacts direct to harbor, if that is possible.

| `oci://registry.venafi.cloud/charts/venafi-kubernetes-agent` | Automatically mirrored by Harbor Replication rule |
| `oci://private-registry.venafi.cloud/charts/venafi-kubernetes-agent` | Automatically mirrored by Harbor Replication rule |
| `oci://private-registry.venafi.eu/charts/venafi-kubernetes-agent` | Automatically mirrored by Harbor Replication rule |
Expand Down Expand Up @@ -118,3 +121,7 @@ v1.1.0 (Git tag in the jetstack-secure repo)
### Step 2: Test the Helm chart "venafi-kubernetes-agent" with venctl connect

NOTE(mael): TBD

### Step 3: Test the Helm chart "cyberark-disco-agent"

NOTE(wallrj): TBD
12 changes: 8 additions & 4 deletions hack/ark/test-e2e.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,11 @@ trap 'rm -rf "${tmp_dir}"' EXIT

pushd "${tmp_dir}"
> release.env
make -C "$root_dir" ark-release GITHUB_OUTPUT="${tmp_dir}/release.env"
make -C "$root_dir" ark-release \
GITHUB_OUTPUT="${tmp_dir}/release.env" \
OCI_SIGN_ON_PUSH=false \
oci_platforms="" \
ARK_OCI_BASE="${OCI_BASE}"
cat release.env
source release.env

Expand All @@ -61,15 +65,15 @@ kubectl create secret generic agent-credentials \
--from-literal=ARK_SUBDOMAIN=$ARK_SUBDOMAIN \
--from-literal=ARK_DISCOVERY_API=$ARK_DISCOVERY_API

helm upgrade agent "oci://${RELEASE_OCI_CHART}@${RELEASE_OCI_CHART_DIGEST}" \
--version "${RELEASE_OCI_CHART_TAG}" \
helm upgrade agent "oci://${ARK_CHART}@${ARK_CHART_DIGEST}" \
--version "${ARK_CHART_TAG}" \
--install \
--wait \
--create-namespace \
--namespace "$NAMESPACE" \
--set pprof.enabled=true \
--set fullnameOverride=disco-agent \
--set "image.digest=${RELEASE_OCI_IMAGE_DIGEST}" \
--set "image.digest=${ARK_IMAGE_DIGEST}" \
--set-json "podLabels={\"disco-agent.cyberark.cloud/test-id\": \"${RANDOM}\"}"

kubectl rollout status deployments/disco-agent --namespace "${NAMESPACE}"
Expand Down
2 changes: 0 additions & 2 deletions make/00_mod.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,6 @@ repo_name := github.com/jetstack/jetstack-secure
# third-party modules.
generate-golangci-lint-config: repo_name := github.com/jetstack/preflight

OCI_BASE ?= # default to an empty value to avoid warnings
Copy link
Member Author

@wallrj-cyberark wallrj-cyberark Sep 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was only used by the ark- targets, so I moved it to the ark/*.mk files for context.


license_ignore := gitlab.com/venafi,github.com/jetstack

kind_cluster_name := preflight
Expand Down
10 changes: 5 additions & 5 deletions make/ark/00_mod.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,20 +7,20 @@ go_ark_ldflags := \
-X $(repo_name)/pkg/version.BuildDate=$(shell date "+%F-%T-%Z") \

oci_ark_base_image_flavor := static
oci_ark_image_name := quay.io/jetstack/ark-agent
oci_ark_image_name := quay.io/jetstack/cyberark-disco-agent
oci_ark_image_tag := $(VERSION)
oci_ark_image_name_development := jetstack.local/ark-agent
oci_ark_image_name_development := jetstack.local/cyberark-disco-agent

# Annotations are the standardised set of annotations we set on every component we publish
oci_ark_build_args := \
--image-annotation="org.opencontainers.image.source"="https://github.com/jetstack/jetstack-secure" \
--image-annotation="org.opencontainers.image.vendor"="CyberArk Software Ltd." \
--image-annotation="org.opencontainers.image.licenses"="EULA - https://www.cyberark.com/contract-terms/" \
--image-annotation="org.opencontainers.image.authors"="TODO" \
--image-annotation="org.opencontainers.image.authors"="CyberArk Software Ltd." \
--image-annotation="org.opencontainers.image.title"="CyberArk Discovery and Context Agent" \
--image-annotation="org.opencontainers.image.description"="Gathers machine identity data from Kubernetes clusters." \
--image-annotation="org.opencontainers.image.url"="TODO" \
--image-annotation="org.opencontainers.image.documentation"="TODO" \
--image-annotation="org.opencontainers.image.url"="https://www.cyberark.com/products/" \
--image-annotation="org.opencontainers.image.documentation"="https://docs.cyberark.com" \
--image-annotation="org.opencontainers.image.version"="$(VERSION)" \
--image-annotation="org.opencontainers.image.revision"="$(GITCOMMIT)"

Expand Down
49 changes: 28 additions & 21 deletions make/ark/02_mod.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,31 +1,38 @@
# Makefile targets for CyberArk Discovery and Context

# The base OCI repository for all CyberArk Discovery and Context artifacts
ARK_OCI_BASE ?= quay.io/jetstack

# The OCI repository (without tag) for the CyberArk Discovery and Context Agent Docker image
# Can be overridden when calling `make ark-release` to push to a different repository.
ARK_IMAGE ?= $(ARK_OCI_BASE)/cyberark-disco-agent

# The OCI repository (without tag) for the CyberArk Discovery and Context Helm chart
# Can be overridden when calling `make ark-release` to push to a different repository.
ARK_CHART ?= $(ARK_OCI_BASE)/charts/cyberark-disco-agent

# Used to output variables when running in GitHub Actions
GITHUB_OUTPUT ?= /dev/stderr

.PHONY: ark-release
## Publish all release artifacts (image + helm chart)
## @category CyberArk Discovery and Context
ark-release: oci_ark_image_name := $(OCI_BASE)/images/cyberark-disco-agent
ark-release: OCI_SIGN_ON_PUSH := false
ark-release: oci_platforms := linux/amd64
ark-release: helm_chart_source_dir := deploy/charts/cyberark-disco-agent
ark-release: helm_chart_image_name := $(OCI_BASE)/charts/cyberark-disco-agent
ark-release: helm_chart_version := $(helm_chart_version)
ark-release: oci_ark_image_digest_path := $(bin_dir)/scratch/image/oci-layout-ark.digests
ark-release: helm_digest_path := $(bin_dir)/scratch/helm/cyberark-disco-agent-$(helm_chart_version).digests
ark-release:
$(MAKE) oci-push-ark helm-chart-oci-push \
oci_ark_image_name="$(oci_ark_image_name)" \
OCI_SIGN_ON_PUSH="$(OCI_SIGN_ON_PUSH)" \
oci_platforms="$(oci_platforms)" \
helm_image_name="$(oci_ark_image_name)" \
oci_ark_image_name="$(ARK_IMAGE)" \
helm_image_name="$(ARK_IMAGE)" \
helm_image_tag="$(oci_ark_image_tag)" \
helm_chart_source_dir="$(helm_chart_source_dir)" \
helm_chart_image_name="$(helm_chart_image_name)"
helm_chart_source_dir=deploy/charts/cyberark-disco-agent \
helm_chart_image_name="$(ARK_CHART)"
Copy link
Member Author

@wallrj-cyberark wallrj-cyberark Sep 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TBH I don't know whether these variables should be set as target specific variables or as sub-make variables in the rule or both....these ark- targets are a temporary hack because makefile-modules doesn't really support multiple charts.
This combination of variables and overrides seems to work...but I can't explain why.


@echo "RELEASE_OCI_IMAGE=$(oci_ark_image_name)" >> "$(GITHUB_OUTPUT)"
@echo "RELEASE_OCI_IMAGE_TAG=$(oci_ark_image_tag)" >> "$(GITHUB_OUTPUT)"
@echo "RELEASE_OCI_IMAGE_DIGEST=$$(head -1 $(oci_ark_image_digest_path))" >> "$(GITHUB_OUTPUT)"
@echo "RELEASE_OCI_CHART=$(helm_chart_image_name)" >> "$(GITHUB_OUTPUT)"
@echo "RELEASE_OCI_CHART_TAG=$(helm_chart_version)" >> "$(GITHUB_OUTPUT)"
@echo "RELEASE_OCI_CHART_DIGEST=$$(head -1 $(helm_digest_path))" >> "$(GITHUB_OUTPUT)"
@echo "ARK_IMAGE=$(ARK_IMAGE)" >> "$(GITHUB_OUTPUT)"
@echo "ARK_IMAGE_TAG=$(oci_ark_image_tag)" >> "$(GITHUB_OUTPUT)"
@echo "ARK_IMAGE_DIGEST=$$(head -1 $(oci_ark_image_digest_path))" >> "$(GITHUB_OUTPUT)"
@echo "ARK_CHART=$(ARK_CHART)" >> "$(GITHUB_OUTPUT)"
@echo "ARK_CHART_TAG=$(helm_chart_version)" >> "$(GITHUB_OUTPUT)"
@echo "ARK_CHART_DIGEST=$$(head -1 $(helm_digest_path))" >> "$(GITHUB_OUTPUT)"

@echo "Release complete!"

Expand All @@ -40,11 +47,11 @@ ark-test-e2e: $(NEEDS_KIND) $(NEEDS_KUBECTL) $(NEEDS_HELM)
## Verify the Helm chart
## @category CyberArk Discovery and Context
ark-verify:
$(MAKE) verify-helm-lint verify-helm-values verify-pod-security-standards verify-helm-kubeconform\
$(MAKE) verify-helm-lint verify-helm-values verify-pod-security-standards verify-helm-kubeconform \
helm_chart_source_dir=deploy/charts/cyberark-disco-agent \
helm_chart_image_name=$(OCI_BASE)/charts/cyberark-disco-agent
helm_chart_image_name=$(ARK_CHART)

shared_verify_targets_dirty += ark-verify
shared_verify_targets += ark-verify
Copy link
Member Author

@wallrj-cyberark wallrj-cyberark Sep 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tim explained what _dirty means...something to do with the "dirty" state of the working tree when we use the verify.sh script...but I still don't understand. By experimentation I found that it wasn't actually necessary to use the _dirty variable here. I used it originally out of desparation to get the ark-verify added to the general verify dependencies.


.PHONY: ark-generate
## Generate Helm chart documentation and schema
Expand Down