feat: Use ghcr.io rather than Docker Hub

.envrc

@@ -1,3 +1,4 @@
 strict_env
+use_asdf
 PATH_add .local/bin
 source_env_if_exists .envrc.local

.github/workflows/checks.yml

@@ -15,6 +15,7 @@ on:
 
 permissions:
   contents: read
+  pull-requests: write
 
 jobs:
   unit-test:
@@ -37,6 +38,7 @@ jobs:
 
   e2e-test:
     runs-on: ubuntu-22.04
+
     steps:
       - name: Check out code
         uses: actions/checkout@v3
@@ -51,19 +53,9 @@ jobs:
         if: steps.check_e2e_files.outputs.files_exists == 'true'
         uses: asdf-vm/actions/setup@v1
 
-      - name: Login to Docker Hub
-        if: steps.check_e2e_files.outputs.files_exists == 'true'
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
       - name: Run e2e tests
         if: steps.check_e2e_files.outputs.files_exists == 'true'
         run: make e2e-test
-        env:
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
 
   lint:
     runs-on: ubuntu-22.04
@@ -80,7 +72,7 @@ jobs:
         with:
           fail_on_error: true
           reporter: github-pr-review
-          go_version: ${{ fromJson(steps.versions.outputs.tools).golangci }}
+          go_version: ${{ fromJson(steps.versions.outputs.tools).golang }}
           golangci_lint_version: v${{ fromJson(steps.versions.outputs.tools).golangci-lint }}
 
   generated:
@@ -125,6 +117,12 @@ jobs:
         with:
           shfmt-version: ${{ fromJson(steps.versions.outputs.tools).shfmt }}
 
+      - name: Install asdf
+        uses: asdf-vm/actions/setup@v1
+
+      - name: Install helm-docs
+        run: make install-tool.helm-docs
+
       - uses: pre-commit/[email protected]
         with:
           extra_args: --all-files --show-diff-on-failure

.github/workflows/release-main.yaml

@@ -8,6 +8,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: write
+  packages: write
+
 jobs:
   release-please:
     runs-on: ubuntu-22.04
@@ -29,13 +33,6 @@ jobs:
         name: Install tools via asdf
         uses: asdf-vm/actions/install@v1
 
-      - if: ${{ steps.release-please.outputs.release_created }}
-        name: Login to Docker Hub
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
       - if: ${{ steps.release-please.outputs.release_created }}
         name: Release
         run: make release

.go-tools

@@ -1,4 +1,4 @@
 github.com/oligot/[email protected]
-gotest.tools/gotestsum@v1.8.2
+gotest.tools/gotestsum@v1.9.0
 github.com/segmentio/[email protected]
-github.com/google/go-containerregistry/cmd/crane@v0.12.1
+github.com/google/go-containerregistry/cmd/crane@v0.13.0

.golangci.yml

@@ -3,7 +3,6 @@
 
 run:
   timeout: 5m
-  go: '1.17'
   skip-files:
     - "^zz_generated.*"
   build-tags:

.goreleaser.yml

@@ -74,28 +74,24 @@ builds:
         - cmd: make SKIP_UPX={{ if index .Env "SKIP_UPX" }}{{ .Env.SKIP_UPX }}{{ else }}{{ .IsSnapshot }}{{ end }} GOOS={{ .Os }} GOARCH={{ .Arch }} UPX_TARGET={{ .Path }} upx
 archives:
   - name_template: '{{ .ProjectName }}_v{{trimprefix .Version "v"}}_{{ .Os }}_{{ .Arch }}'
-  # This is a hack documented in https://github.com/goreleaser/goreleaser/blob/df0216d5855e9283d2106fb5acdb0e7b528a56e8/www/docs/customization/archive.md#packaging-only-the-binaries
-    files:
-      - none*
     builds:
       - dynamic-credential-provider
+    rlcp: true
   - name_template: 'static-credential-provider_v{{trimprefix .Version "v"}}_{{ .Os }}_{{ .Arch }}'
-    # This is a hack documented in https://github.com/goreleaser/goreleaser/blob/df0216d5855e9283d2106fb5acdb0e7b528a56e8/www/docs/customization/archive.md#packaging-only-the-binaries
     id: static-credential-provider
-    files:
-      - none*
     builds:
       - static-credential-provider
+    rlcp: true
 dockers:
   - image_templates:
       # Specify the image tag including `-amd64` suffix if the build is not a snapshot build or is not being built on
       # arm64 machine. This allows for using the snapshot image build without the archtecture specific suffix
-      # consistently on local machines, i.e. can always use `mesosphere/dynamic-credential-provider:v<VERSION>` on the machine the snapshot
+      # consistently on local machines, i.e. can always use `ghcr.io/mesosphere/dynamic-credential-provider:v<VERSION>` on the machine the snapshot
       # is built on.
       #
       # For a release build the `-amd64` suffix will always be included and the `docker_manifests` specification below
       # will create the final multiplatform manifest to be pushed to the registry.
-      - 'mesosphere/dynamic-credential-provider:v{{trimprefix .Version "v"}}{{ if or (not .IsSnapshot) (not (eq .Runtime.Goarch "amd64")) }}-amd64{{ end }}'
+      - 'ghcr.io/mesosphere/dynamic-credential-provider:v{{trimprefix .Version "v"}}{{ if or (not .IsSnapshot) (not (eq .Runtime.Goarch "amd64")) }}-amd64{{ end }}'
     use: buildx
     dockerfile: Dockerfile
     extra_files:
@@ -113,12 +109,12 @@ dockers:
   - image_templates:
       # Specify the image tag including `-amd64v8` suffix if the build is not a snapshot build or is not being built on
       # arm64 machine. This allows for using the snapshot image build without the archtecture specific suffix
-      # consistently on local machines, i.e. can always use `mesosphere/dynamic-credential-provider:v<VERSION>` on the machine the snapshot
+      # consistently on local machines, i.e. can always use `ghcr.io/mesosphere/dynamic-credential-provider:v<VERSION>` on the machine the snapshot
       # is built on.
       #
       # For a release build the `-amd64v8` suffix will always be included and the `docker_manifests` specification below
       # will create the final multiplatform manifest to be pushed to the registry.
-    - 'mesosphere/dynamic-credential-provider:v{{trimprefix .Version "v"}}{{ if or (not .IsSnapshot) (not (eq .Runtime.Goarch "arm64")) }}-arm64v8{{ end }}'
+    - 'ghcr.io/mesosphere/dynamic-credential-provider:v{{trimprefix .Version "v"}}{{ if or (not .IsSnapshot) (not (eq .Runtime.Goarch "arm64")) }}-arm64v8{{ end }}'
     use: buildx
     goarch: arm64
     dockerfile: Dockerfile
@@ -135,10 +131,10 @@ dockers:
       - "--build-arg=GO_VERSION={{.Env.GO_VERSION}}"
       - "--build-arg=CLOUD_PROVIDER_GCP_VERSION={{.Env.CLOUD_PROVIDER_GCP_VERSION}}"
 docker_manifests:
-  - name_template: mesosphere/dynamic-credential-provider:v{{trimprefix .Version "v"}}
+  - name_template: ghcr.io/mesosphere/dynamic-credential-provider:v{{trimprefix .Version "v"}}
     image_templates:
-    - mesosphere/dynamic-credential-provider:v{{trimprefix .Version "v"}}-amd64
-    - mesosphere/dynamic-credential-provider:v{{trimprefix .Version "v"}}-arm64v8
+    - ghcr.io/mesosphere/dynamic-credential-provider:v{{trimprefix .Version "v"}}-amd64
+    - ghcr.io/mesosphere/dynamic-credential-provider:v{{trimprefix .Version "v"}}-arm64v8
 checksum:
   name_template: 'checksums.txt'
 snapshot:

.pre-commit-config.yaml

@@ -6,22 +6,18 @@ repos:
   hooks:
   - id: golangci-lint
     name: golangci-lint
-    entry: make lint
+    entry: make go-generate lint
     language: system
-    files: "(.*\\.go|go.mod|go.sum)$"
-    pass_filenames: false
-  - id: go-generate
-    name: go-generate
-    entry: make go-generate
-    language: system
-    files: "(.*\\.go|go.mod|go.sum)$"
+    files: "(.*\\.go|go.mod|go.sum|go.mk)$"
     pass_filenames: false
+    stages: [commit]
 - repo: https://github.com/tekwizely/pre-commit-golang
   rev: v1.0.0-rc.1
   hooks:
   - id: go-mod-tidy-repo
+    stages: [commit]
 - repo: https://github.com/pre-commit/pre-commit-hooks
-  rev: v4.3.0
+  rev: v4.4.0
   hooks:
   - id: trailing-whitespace
     stages: [commit]
@@ -48,7 +44,7 @@ repos:
   - id: end-of-file-fixer
     stages: [commit]
 - repo: https://github.com/jorisroovers/gitlint
-  rev: v0.17.0
+  rev: v0.19.0dev
   hooks:
   - id: gitlint
     stages: [commit-msg]
@@ -61,19 +57,19 @@ repos:
   - id: script-must-have-extension
     stages: [commit]
 - repo: https://github.com/shellcheck-py/shellcheck-py
-  rev: v0.8.0.4
+  rev: v0.9.0.2
   hooks:
   - id: shellcheck
     stages: [commit]
-    args: ["-e", "SC2211"]
+    args: ["-x"]
 - repo: https://github.com/igorshubovych/markdownlint-cli
-  rev: v0.32.2
+  rev: v0.33.0
   hooks:
   - id: markdownlint
     stages: [commit]
-    exclude: ^CHANGELOG.md$
+    exclude: ^(CHANGELOG.md|charts/.+/README.md)$
 - repo: https://github.com/Lucas-C/pre-commit-hooks
-  rev: v1.3.1
+  rev: v1.4.2
   hooks:
   - id: insert-license
     name: License headers - Go
@@ -92,7 +88,7 @@ repos:
     args:
       - --license-filepath
       - header.txt
-    exclude: ^charts/.+/templates/
+    exclude: ^charts/.+/(templates/.+\.yaml|crds/.+\.yaml)$
   - id: insert-license
     name: License headers - Markdown
     stages: [commit]
@@ -103,3 +99,11 @@ repos:
       - header.txt
       - --comment-style
       - <!--|| -->
+- repo: https://github.com/norwoodj/helm-docs
+  rev: v1.11.0
+  hooks:
+  - id: helm-docs
+    stages: [commit]
+    args:
+      # Make the tool search for charts only under the `example-charts` directory
+      - --chart-search-root=charts

.tool-versions

@@ -1,13 +1,14 @@
-clusterctl 1.2.6
-ginkgo 2.5.1
-gojq 0.12.9
-golang 1.19.3
-golangci-lint 1.50.1
-goreleaser 1.13.1
-helm 3.10.2
-kube-code-generator 0.25.4
-kube-controller-tools 0.10.0
-kubebuilder 3.7.0
-pre-commit 2.20.0
-shfmt 3.5.1
-upx 4.0.1
+clusterctl 1.3.3
+ginkgo 2.8.1
+gojq 0.12.11
+golang 1.20.1
+golangci-lint 1.51.1
+goreleaser 1.15.2
+helm 3.11.1
+kube-code-generator 0.26.1
+kube-controller-tools 0.11.3
+kubebuilder 3.9.0
+pre-commit 3.0.4
+shfmt 3.6.0
+upx 4.0.2
+helm-docs 1.11.0

charts/dynamic-credential-provider/README.md

@@ -0,0 +1,40 @@
+<!--
+ Copyright 2022 D2iQ, Inc. All rights reserved.
+ SPDX-License-Identifier: Apache-2.0
+ -->
+
+# dynamic-credential-provider
+
+![Version: 0.0.0-dev](https://img.shields.io/badge/Version-0.0.0--dev-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v0.0.0-dev](https://img.shields.io/badge/AppVersion-v0.0.0--dev-informational?style=flat-square)
+
+A Helm chart for Kubernetes dynamic credential provider
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| configSync.secrets.dynamicCredentialProviderConfig | string | `"dynamiccredentialproviderconfig"` |  |
+| configSync.secrets.staticCredentialProvider | string | `"staticcredentialproviderauth"` |  |
+| fullnameOverride | string | `""` |  |
+| image.pullPolicy | string | `"IfNotPresent"` |  |
+| image.repository | string | `"ghcr.io/mesosphere/dynamic-credential-provider"` |  |
+| image.tag | string | `""` |  |
+| imagePullSecrets | list | `[]` |  |
+| installer.kubeletImageCredentialProviderBinDir | string | `"/etc/kubernetes/image-credential-provider/"` |  |
+| nameOverride | string | `""` |  |
+| nodeSelector | object | `{}` |  |
+| podAnnotations | object | `{}` |  |
+| podSecurityContext.runAsUser | int | `0` |  |
+| resources | object | `{}` |  |
+| securityContext.capabilities.drop[0] | string | `"ALL"` |  |
+| securityContext.privileged | bool | `true` |  |
+| securityContext.readOnlyRootFilesystem | bool | `true` |  |
+| serviceAccount.annotations | object | `{}` |  |
+| serviceAccount.create | bool | `true` |  |
+| serviceAccount.name | string | `""` |  |
+| tolerations[0].effect | string | `"NoSchedule"` |  |
+| tolerations[0].key | string | `"node-role.kubernetes.io/control-plane"` |  |
+| tolerations[0].operator | string | `"Exists"` |  |
+| tolerations[1].effect | string | `"NoSchedule"` |  |
+| tolerations[1].key | string | `"node-role.kubernetes.io/master"` |  |
+| tolerations[1].operator | string | `"Exists"` |  |

charts/dynamic-credential-provider/README.md.gotmpl

@@ -0,0 +1,21 @@
+<!--
+ Copyright 2022 D2iQ, Inc. All rights reserved.
+ SPDX-License-Identifier: Apache-2.0
+ -->
+
+{{ template "chart.header" . }}
+{{ template "chart.deprecationWarning" . }}
+
+{{ template "chart.badgesSection" . }}
+
+{{ template "chart.description" . }}
+
+{{ template "chart.homepageLine" . }}
+
+{{ template "chart.maintainersSection" . }}
+
+{{ template "chart.sourcesSection" . }}
+
+{{ template "chart.requirementsSection" . }}
+
+{{ template "chart.valuesSection" . }}

charts/dynamic-credential-provider/values.yaml

@@ -10,7 +10,7 @@ configSync:
     staticCredentialProvider: staticcredentialproviderauth
 
 image:
-  repository: mesosphere/dynamic-credential-provider
+  repository: ghcr.io/mesosphere/dynamic-credential-provider
   pullPolicy: IfNotPresent
   tag: ""