Skip to content

Commit babe503

Browse files
ciarams87ciarams87
committed
Automate Operator release
1 parent 2220dbf commit babe503

File tree

11 files changed

+420
-28
lines changed

11 files changed

+420
-28
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,9 @@ jobs:
145145
filters: |
146146
charts:
147147
- charts/nginx-gateway-fabric/**/*
148+
rbac:
149+
- operators/config/rbac/role.yaml
150+
- charts/nginx-gateway-fabric/templates/clusterrole.yaml
148151
149152
- name: Output Variables
150153
id: vars
@@ -164,6 +167,10 @@ jobs:
164167
- name: Check if all the generated files are up to date
165168
run: make generate-all && git diff --exit-code
166169

170+
- name: Verify Operator RBAC Synchronization
171+
if: steps.filter.outputs.rbac == 'true'
172+
run: ./operators/scripts/verify-rbac-sync.sh
173+
167174
unit-tests:
168175
name: Unit Tests
169176
runs-on: ubuntu-24.04
@@ -460,6 +467,27 @@ jobs:
460467
id-token: write # for docker/login to login to NGINX registry
461468
secrets: inherit
462469

470+
redhat-certification:
471+
name: Submit images for RedHat certification
472+
needs: [build-oss, build-operator]
473+
if: ${{ inputs.is_production_release }}
474+
strategy:
475+
fail-fast: false
476+
matrix:
477+
include:
478+
- image: ngf
479+
tag: ${{ inputs.release_version }}
480+
- image: nginx
481+
tag: ${{ inputs.release_version }}
482+
- image: operator
483+
tag: ${{ inputs.operator_version }}
484+
uses: ./.github/workflows/redhat-certification.yml
485+
with:
486+
image: ${{ matrix.image }}
487+
tag: ${{ matrix.tag }}
488+
dry_run: ${{ inputs.dry_run }}
489+
secrets: inherit
490+
463491
functional-tests:
464492
name: Functional tests
465493
needs: [vars, build-oss, build-plus]

‎.github/workflows/operator-bundle-pr.yml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
name: Operator Bundle PR
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
operator-version:
7+
description: "Operator version for bundle generation"
8+
required: true
9+
default: "0.0.0"
10+
submit-to-redhat:
11+
description: "Submit bundle to RedHat certified-operators repo"
12+
required: false
13+
type: boolean
14+
default: false
15+
16+
defaults:
17+
run:
18+
shell: bash
19+
20+
permissions:
21+
contents: read
22+
23+
jobs:
24+
bundle:
25+
runs-on: ubuntu-24.04
26+
permissions:
27+
contents: write
28+
pull-requests: write
29+
steps:
30+
- name: Checkout Repository
31+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
32+
33+
- name: Setup Go
34+
uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
35+
with:
36+
go-version-file: go.mod
37+
38+
- name: Install operator-sdk
39+
run: |
40+
OPERATOR_SDK_VERSION=v1.42.0 # renovate: datasource=github-tags depName=operator-framework/operator-sdk
41+
curl -sSLo /tmp/operator-sdk https://github.com/operator-framework/operator-sdk/releases/download/${OPERATOR_SDK_VERSION}/operator-sdk_linux-amd64
42+
chmod +x /tmp/operator-sdk
43+
sudo mv /tmp/operator-sdk /usr/local/bin/operator-sdk
44+
45+
- name: Generate Bundle
46+
working-directory: operators
47+
run: |
48+
make bundle-release
49+
50+
- name: Create Pull Request
51+
uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
52+
with:
53+
token: ${{ secrets.GITHUB_TOKEN }}
54+
commit-message: Generate operator bundle for v${{ inputs.operator-version }}
55+
title: Operator Bundle v${{ inputs.operator-version }}
56+
draft: true
57+
delete-branch: true
58+
branch: operator/bundle-${{ inputs.operator-version }}
59+
author: nginx-bot <integrations@nginx.com>
60+
committer: nginx-bot <integrations@nginx.com>
61+
body: |
62+
This automated PR generates the operator bundle for v${{ inputs.operator-version }}.
63+
64+
## What's Changed
65+
- Updated NGF image versions in sample manifests using image digests
66+
- Generated bundle manifests and metadata
67+
- Updated ClusterServiceVersion with proper annotations and descriptors
68+
- Added OpenShift compatibility annotations
69+
70+
- name: Checkout certified-operators repo
71+
if: ${{ inputs.submit-to-redhat }}
72+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
73+
with:
74+
token: ${{ secrets.NGINX_PAT }}
75+
repository: nginx-bot/certified-operators
76+
path: certified-operators
77+
78+
- name: Update certified-operators repo
79+
if: ${{ inputs.submit-to-redhat }}
80+
working-directory: certified-operators/operators/nginx-gateway-fabric-operator
81+
run: |
82+
mkdir v${{ inputs.operator-version }}
83+
cp -R ../../../operators/bundle/manifests v${{ inputs.operator-version }}/
84+
cp -R ../../../operators/bundle/metadata v${{ inputs.operator-version }}/
85+
86+
- name: Commit and push to certified-operators
87+
if: ${{ inputs.submit-to-redhat }}
88+
uses: stefanzweifel/git-auto-commit-action@28e16e81777b558cc906c8750092100bbb34c5e3 # v7.0.0
89+
with:
90+
commit_message: operator nginx-gateway-fabric-operator (v${{ inputs.operator-version }})
91+
commit_author: nginx-bot <integrations@nginx.com>
92+
commit_user_name: nginx-bot
93+
commit_user_email: integrations@nginx.com
94+
create_branch: true
95+
branch: update-nginx-gateway-fabric-operator-to-v${{ inputs.operator-version }}
96+
repository: certified-operators
97+
98+
- name: Create PR to RedHat certified-operators
99+
if: ${{ inputs.submit-to-redhat }}
100+
working-directory: certified-operators
101+
run: |
102+
gh pr create --title "operator nginx-gateway-fabric-operator (v${{ inputs.operator-version }})" --body "Update nginx-gateway-fabric-operator to v${{ inputs.operator-version }}" --head nginx-bot:update-nginx-gateway-fabric-operator-to-v${{ inputs.operator-version }} --base main --repo redhat-openshift-ecosystem/certified-operators
103+
env:
104+
GITHUB_TOKEN: ${{ secrets.NGINX_PAT }}

‎.github/workflows/redhat-certification.yml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: RedHat Certification
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
image:
7+
description: "Image type to certify (ngf, nginx, operator)"
8+
required: true
9+
type: string
10+
tag:
11+
description: "Image tag to certify"
12+
required: true
13+
type: string
14+
dry_run:
15+
description: "Run preflight checks without submitting"
16+
required: false
17+
type: boolean
18+
default: false
19+
20+
defaults:
21+
run:
22+
shell: bash
23+
24+
permissions:
25+
contents: read
26+
27+
jobs:
28+
certify:
29+
name: Submit ${{ inputs.image }} image for certification
30+
runs-on: ubuntu-24.04
31+
steps:
32+
- name: Set image reference
33+
id: image
34+
run: |
35+
case "${{ inputs.image }}" in
36+
ngf)
37+
echo "ref=ghcr.io/${{ github.repository_owner }}/nginx-gateway-fabric:${{ inputs.tag }}-ubi" >> $GITHUB_OUTPUT
38+
;;
39+
nginx)
40+
echo "ref=ghcr.io/${{ github.repository_owner }}/nginx-gateway-fabric/nginx:${{ inputs.tag }}-ubi" >> $GITHUB_OUTPUT
41+
;;
42+
operator)
43+
echo "ref=ghcr.io/${{ github.repository_owner }}/nginx-gateway-fabric/operator:${{ inputs.tag }}" >> $GITHUB_OUTPUT
44+
;;
45+
*)
46+
echo "Error: Unknown image type: ${{ inputs.image }}"
47+
exit 1
48+
;;
49+
esac
50+
51+
- name: Set component ID environment variable
52+
run: |
53+
case "${{ inputs.image }}" in
54+
ngf)
55+
echo "COMPONENT_ID=${{ secrets.CERTIFICATION_COMPONENT_ID_NGF }}" >> $GITHUB_ENV
56+
;;
57+
nginx)
58+
echo "COMPONENT_ID=${{ secrets.CERTIFICATION_COMPONENT_ID_NGINX }}" >> $GITHUB_ENV
59+
;;
60+
operator)
61+
echo "COMPONENT_ID=${{ secrets.CERTIFICATION_COMPONENT_ID_OPERATOR }}" >> $GITHUB_ENV
62+
;;
63+
esac
64+
65+
- name: Install preflight
66+
run: |
67+
PREFLIGHT_VERSION=1.14.1 # renovate: datasource=github-tags depName=redhat-openshift-ecosystem/openshift-preflight
68+
curl -sSLo /tmp/preflight https://github.com/redhat-openshift-ecosystem/openshift-preflight/releases/download/${PREFLIGHT_VERSION}/preflight-linux-amd64
69+
chmod +x /tmp/preflight
70+
sudo mv /tmp/preflight /usr/local/bin/preflight
71+
preflight version
72+
73+
- name: Run preflight check${{ !inputs.dry_run && ' and submit' || '' }}
74+
run: |
75+
preflight check container ${{ steps.image.outputs.ref }} \
76+
--pyxis-api-token="${{ secrets.PYXIS_API_TOKEN }}" \
77+
--certification-component-id="${COMPONENT_ID}" \
78+
${{ !inputs.dry_run && '--submit' || '' }}

‎.github/workflows/release-pr.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ on:
77
description: "Version to release"
88
required: true
99
default: "0.0.0"
10+
operator-version:
11+
description: "Operator version to release"
12+
required: true
13+
default: "0.0.0"
1014

1115
defaults:
1216
run:
@@ -55,6 +59,22 @@ jobs:
5559
include: "charts/nginx-gateway-fabric/*.yaml"
5660
regex: false
5761

62+
- name: Find and Replace
63+
uses: jacobtomlinson/gha-find-replace@f1069b438f125e5395d84d1c6fd3b559a7880cb5 # 3.0.5
64+
with:
65+
find: "edge"
66+
replace: ${{ inputs.operator-version }}
67+
include: "operators/Dockerfile"
68+
regex: false
69+
70+
- name: Find and Replace
71+
uses: jacobtomlinson/gha-find-replace@f1069b438f125e5395d84d1c6fd3b559a7880cb5 # 3.0.5
72+
with:
73+
find: "VERSION ?= edge"
74+
replace: "VERSION ?= ${{ inputs.operator-version }}"
75+
include: "operators/Makefile"
76+
regex: false
77+
5878
- name: Find and Replace
5979
uses: jacobtomlinson/gha-find-replace@f1069b438f125e5395d84d1c6fd3b559a7880cb5 # 3.0.5
6080
with:

‎.yamllint.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ rules:
2929
check-multi-line-strings: true
3030
ignore: |
3131
operators/**/*
32+
.github/workflows/redhat-certification.yml
3233
key-duplicates: enable
3334
key-ordering: disable
3435
line-length:

‎Makefile‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,11 @@ generate-helm-schema: ## Generate the Helm chart schema
165165
go run github.com/dadav/helm-schema/cmd/helm-schema@$(HELM_SCHEMA_VERSION) --chart-search-root=charts --add-schema-reference "--skip-auto-generation=required,additionalProperties" --append-newline
166166

167167
.PHONY: generate-all
168-
generate-all: generate generate-crds generate-helm-schema generate-manifests generate-api-docs generate-helm-docs ## Generate all the necessary files
168+
generate-all: generate generate-crds generate-helm-schema generate-manifests generate-api-docs generate-helm-docs verify-operator-rbac ## Generate all the necessary files
169+
170+
.PHONY: verify-operator-rbac
171+
verify-operator-rbac: ## Verify operator RBAC is in sync with Helm chart
172+
@./operators/scripts/verify-rbac-sync.sh
169173

170174
.PHONY: clean
171175
clean: ## Clean the build

‎docs/developer/release-process.md‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -69,22 +69,34 @@ To create a new release, follow these steps:
6969
- Build NGF, NGINX and NGINX Plus container images with the release tag `X.Y.Z` and push them to the registries.
7070
- Package and publish the Helm chart to the registry.
7171
- Create a GitHub release with an autogenerated changelog and attached release artifacts.
72-
7. Prepare and merge a PR into the main branch to update with similar information that you did in the release branch docs PR. Specifically:
72+
- Automatically submit UBI images for RedHat certification: The NGF, NGINX, and Operator UBI images are automatically submitted to the RedHat Partner Portal for preflight certification.
73+
7. Operator Bundle Generation:
74+
- You can generate and submit the operator bundle by running the [Operator Bundle PR workflow](https://github.com/nginx/nginx-gateway-fabric/actions/workflows/operator-bundle-pr.yml) with the following inputs:
75+
- Set `operator-version` to the operator version (e.g., `1.0.1`, without the `v` prefix)
76+
- Set `submit-to-redhat` to `true` if you want to automatically open a PR to the [RedHat certified-operators repository](https://github.com/redhat-openshift-ecosystem/certified-operators)
77+
- This workflow will:
78+
- Generate the operator bundle manifests using image digests
79+
- Create a draft PR in the NGF repository with the bundle changes
80+
- If `submit-to-redhat` is enabled, automatically fork and open a PR to the RedHat certified-operators repo
81+
- Review and merge the internal bundle PR once approved
82+
- Monitor the RedHat certified-operators PR for review feedback
83+
8. Prepare and merge a PR into the main branch to update with similar information that you did in the release branch docs and operator bundle PRs. Specifically:
7384
1. [README](/README.md) to include the information about the latest release.
7485
2. [changelog](/CHANGELOG.md).
7586
3. Helm chart `version` field.
7687
4. `GW_API_PREV_VERSION` in tests Makefile, if necessary.
7788
5. Any references in the docs to the previous release.
7889
6. Any installation instructions to ensure that the supported Gateway API and NGF versions are correct. Specifically, helm README.
79-
8. Prepare and merge a PR into the main branch of the [documentation repository](https://github.com/nginx/documentation) from the relevant release branch, such as `ngf-release-2.0`.
90+
7. The operator bundle changes.
91+
9. Prepare and merge a PR into the main branch of the [documentation repository](https://github.com/nginx/documentation) from the relevant release branch, such as `ngf-release-2.0`.
8092
- In the NGF repo, run `make generate-api-docs` and copy the generated file from `docs/api/content.md` into the documentation repo to `content/ngf/reference/api.md`.
8193
- Update the HTML file located at `layouts/shortcodes/version-ngf.html` with the latest version. Ensure you do not add an empty line to the file.
8294
- Documentation is built and deployed automatically from `main`, and will trigger when merging to it.
8395
- Create a new branch for the next release version, in the format `ngf-release-<i>.<i>`, substituting the *i* placeholders for major and minor version numbers.
84-
9. Close the issue created in Step 1.
85-
10. Ensure that the [associated milestone](https://github.com/nginx/nginx-gateway-fabric/milestones) is closed.
86-
11. Verify that published artifacts in the release can be installed properly.
87-
12. Submit the `conformance-profile.yaml` artifact from the release to the [Gateway API repo](https://github.com/kubernetes-sigs/gateway-api/tree/main/conformance/reports).
96+
10. Close the issue created in Step 1.
97+
11. Ensure that the [associated milestone](https://github.com/nginx/nginx-gateway-fabric/milestones) is closed.
98+
12. Verify that published artifacts in the release can be installed properly.
99+
13. Submit the `conformance-profile.yaml` artifact from the release to the [Gateway API repo](https://github.com/kubernetes-sigs/gateway-api/tree/main/conformance/reports).
88100
- Create a fork of the repository
89101
- Name the file based on the requirements of the [README](https://github.com/kubernetes-sigs/gateway-api/blob/main/conformance/reports/README.md). Update the README in the ngf directory and update the site source if necessary (see following example).
90102
- Open a PR. [Example](https://github.com/kubernetes-sigs/gateway-api/pull/3149)
@@ -105,5 +117,5 @@ To create a new release, follow these steps:
105117
branch.
106118
4. Test the release branch for release-readiness.
107119
5. If a problem is found, return to Step 2.
108-
6. Follow Steps 5-7 from the [Major or Minor Release](#major-or-minor-release) section.
120+
6. Follow Steps 5-8 from the [Major or Minor Release](#major-or-minor-release) section.
109121
7. Prepare and merge a PR into the main branch of the [documentation repository](https://github.com/nginx/documentation) to update the NGF version in `layouts/shortcodes/version-ngf.html`. If any of our APIs have changed, in the NGF repo, run `make generate-api-docs` and copy the generated file from `docs/api/content.md` into the documentation repo to `content/ngf/reference/api.md`.

‎operators/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ COPY LICENSE /licenses/LICENSE
1010
LABEL name="nginx-gateway-fabric-operator" \
1111
maintainer="kubernetes@nginx.com" \
1212
vendor="F5 NGINX" \
13-
version="1.0.0" \
13+
version="edge" \
1414
release="1" \
1515
summary="NGINX Gateway Fabric Operator" \
1616
description="Helm-based operator for NGINX Gateway Fabric"

‎operators/Makefile‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# VERSION defines the project version for the bundle.
22
# Update this value when you upgrade the version of the operator.
3-
VERSION ?= 1.0.1
3+
VERSION ?= edge
44

55
# renovate: datasource=github-tags depName=operator-framework/operator-sdk
66
OPERATOR_SDK_VERSION ?= v1.42.0
@@ -41,6 +41,10 @@ all: docker-build
4141
help: ## Display this help.
4242
@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
4343

44+
.PHONY: verify-rbac
45+
verify-rbac: ## Verify operator RBAC includes all Helm chart permissions.
46+
@./scripts/verify-rbac-sync.sh
47+
4448
##@ Build
4549

4650
.PHONY: run
@@ -140,7 +144,7 @@ endif
140144
endif
141145

142146
.PHONY: bundle
143-
bundle: kustomize operator-sdk ## Generate bundle manifests and metadata, then validate generated files.
147+
bundle: verify-rbac kustomize operator-sdk ## Generate bundle manifests and metadata, then validate generated files.
144148
$(OPERATOR_SDK) generate kustomize manifests -q
145149
cd config/manager && $(KUSTOMIZE) edit set image controller=$(IMG)
146150
$(KUSTOMIZE) build config/manifests | $(OPERATOR_SDK) generate bundle $(BUNDLE_GEN_FLAGS)

0 commit comments

Comments
 (0)