Skip to content

Commit 82ea8d1

Browse files
litaocdlsxd
litaocdl
authored and
sxd
committed
Initial Commit
Signed-off-by: Gabriele Bartolini <[email protected]>
0 parents  commit 82ea8d1

14 files changed

+776
-0
lines changed

‎.github/dependabot.yml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
directory: "/"
5+
schedule:
6+
interval: "daily"

‎.github/workflows/build.yml

+91
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
name: Continuous Delivery
2+
3+
on:
4+
push:
5+
tags:
6+
- v*
7+
workflow_dispatch:
8+
9+
defaults:
10+
run:
11+
shell: 'bash -Eeuo pipefail -x {0}'
12+
13+
env:
14+
IMAGE_STAGING: ghcr.io/cloudnative-pg/pgbouncer-testing
15+
IMAGE_RELEASE: ghcr.io/cloudnative-pg/pgbouncer
16+
17+
jobs:
18+
build-and-publish:
19+
runs-on: ubuntu-20.04
20+
steps:
21+
-
22+
uses: actions/checkout@v2
23+
with:
24+
fetch-depth: 0
25+
-
26+
name: Detect platforms
27+
id: docker-platforms
28+
run: |
29+
# Now we only support linux/amd64
30+
platforms="linux/amd64"
31+
echo "::set-output name=platforms::${platforms}"
32+
-
33+
name: Set up QEMU
34+
uses: docker/setup-qemu-action@v1
35+
with:
36+
platforms: ${{ steps.docker-platforms.outputs.platforms }}
37+
-
38+
name: Set up Docker Buildx
39+
id: buildx
40+
uses: docker/setup-buildx-action@v1
41+
-
42+
name: Log in to the GitHub Container registry
43+
uses: docker/[email protected]
44+
with:
45+
registry: ghcr.io
46+
username: ${{ github.actor }}
47+
password: ${{ secrets.GITHUB_TOKEN }}
48+
-
49+
name: Set image repository
50+
id: image-repo
51+
run: |
52+
if [[ "${GITHUB_REF}" =~ refs/tags/v(.*) ]]; then
53+
echo "::set-output name=images::${{ env.IMAGE_RELEASE }},${{ env.IMAGE_STAGING }}"
54+
else
55+
echo "::set-output name=images::${{ env.IMAGE_STAGING }}"
56+
fi
57+
-
58+
name: Gather image info
59+
id: gather-versions
60+
run: |
61+
pgbouncer_version=$(jq -r '.PGBOUNCER_VERSION' .versions.json)
62+
release_version=$(jq -r '.IMAGE_RELEASE_VERSION' .versions.json)
63+
debian_version=$(jq -r '.DEBIAN_VERSION' .versions.json)
64+
echo "::set-output name=pgbouncer_version::${pgbouncer_version}"
65+
echo "::set-output name=release_version::${release_version}"
66+
echo "::set-output name=debian_version::${debian_version}"
67+
-
68+
name: Docker meta
69+
id: docker-meta
70+
uses: docker/[email protected]
71+
with:
72+
# list of Docker images to use as base name for tags
73+
images: "${{ steps.image-repo.outputs.images }}"
74+
# generate Docker tags based on the following events/attributes
75+
tags: |
76+
type=match,pattern=v(.*),group=1
77+
type=match,pattern=v(.*)-\d+,group=1
78+
type=ref,event=branch
79+
labels: |
80+
org.opencontainers.image.version=${{ steps.gather-versions.outputs.pgbouncer_version }}
81+
org.opencontainers.image.revision=${{ steps.gather-versions.outputs.release_version }}
82+
org.opencontainers.image.licenses=PostgreSQL
83+
-
84+
name: Build and push
85+
uses: docker/[email protected]
86+
with:
87+
platforms: ${{ steps.docker-platforms.outputs.platforms }}
88+
context: .
89+
push: true
90+
tags: ${{ steps.docker-meta.outputs.tags }}
91+
labels: ${{ steps.docker-meta.outputs.labels }}

‎.github/workflows/update.yml

+141
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
name: Automatic Updates
2+
3+
on:
4+
schedule:
5+
- cron: 0 0 * * *
6+
workflow_dispatch:
7+
8+
defaults:
9+
run:
10+
shell: 'bash -Eeuo pipefail -x {0}'
11+
12+
jobs:
13+
update:
14+
runs-on: ubuntu-20.04
15+
steps:
16+
-
17+
uses: actions/checkout@v2
18+
with:
19+
token: ${{ secrets.REPO_GHA_PAT }}
20+
fetch-depth: 0
21+
-
22+
name: Get latest PgBouncer
23+
run: |
24+
echo PGBOUNCER_VERSION=$(curl -s https://api.github.com/repos/pgbouncer/pgbouncer/releases/latest | jq -r '.assets[].name' | grep -oP "pgbouncer-\K([[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+)(?=\.tar\.gz)") >> $GITHUB_ENV
25+
-
26+
name: Get latest Debian base image
27+
run: |
28+
echo DEBIAN_VERSION=$(curl -SsL "https://registry.hub.docker.com/v2/repositories/library/debian/tags/?name=buster-20&ordering=last_updated&" | jq -r ".results[].name | match(\"buster.*-slim\") | .string" | head -n1) >> $GITHUB_ENV
29+
-
30+
name: Update Dockerfile
31+
run: |
32+
INITIAL_RELEASE_VERSION=$(jq -r '.IMAGE_RELEASE_VERSION' .versions.json)
33+
sed \
34+
-e 's/%%PGBOUNCER_VERSION%%/${{ env.PGBOUNCER_VERSION }}/' \
35+
-e 's/%%DEBIAN_VERSION%%/${{ env.DEBIAN_VERSION }}/' \
36+
-e "s/%%IMAGE_RELEASE_VERSION%%/${INITIAL_RELEASE_VERSION}/" \
37+
Dockerfile.template > Dockerfile
38+
-
39+
name: Set up Docker Buildx
40+
id: buildx
41+
uses: docker/setup-buildx-action@v1
42+
-
43+
name: Build and export to Docker
44+
uses: docker/[email protected]
45+
with:
46+
context: .
47+
load: true
48+
push: false
49+
tags: newimage
50+
-
51+
name: Dockle scan
52+
uses: erzz/[email protected]
53+
with:
54+
image: newimage
55+
exit-code: '1'
56+
failure-threshold: WARN
57+
env:
58+
DOCKLE_IGNORES: DKL-DI-0006
59+
-
60+
name: Extract package list from container
61+
run: |
62+
docker run -t --entrypoint bash newimage -c 'apt list --installed | sort' > packages.txt
63+
-
64+
# We verify if there has been any change in the image. It could be:
65+
# * a pgbouncer update
66+
# * a new Debian base image
67+
# * any change in the installed packages
68+
# * any change in the git repository except the pipeline
69+
name: Check if the image has been updated since the latest tag
70+
run: |
71+
echo UPDATED=false >> $GITHUB_ENV
72+
if git describe --tags; then
73+
current_tag=$(git describe --tags --abbrev=0)
74+
if [[ -n $(git diff --name-status ${current_tag} -- . ':(exclude)README.md' ':(exclude).github' ':(exclude).gitignore') ]]; then
75+
echo UPDATED=true >> $GITHUB_ENV
76+
fi
77+
fi
78+
-
79+
name: Define tag
80+
if: ${{ github.ref == 'refs/heads/main' && env.UPDATED == 'true' }}
81+
run: |
82+
release_number=1
83+
if git describe --tags; then
84+
current_tag=$(git describe --tags --abbrev=0)
85+
current_pgbouncer_version=$(echo $current_tag | cut -d'-' -f 1)
86+
current_pgbouncer_version=${current_pgbouncer_version##v}
87+
current_release=$(echo $current_tag | cut -d'-' -f 2)
88+
if [ $current_pgbouncer_version = ${{ env.PGBOUNCER_VERSION }} ]; then
89+
release_number=$((current_release+1))
90+
fi
91+
fi
92+
echo IMAGE_RELEASE_VERSION=${release_number} >> $GITHUB_ENV
93+
echo TAG=${{ env.PGBOUNCER_VERSION }}-${release_number} >> $GITHUB_ENV
94+
-
95+
# In case we are releasing, we need to re-generate the Dockerfile from
96+
# the template again since now we also know the proper release version.
97+
name: Update Dockerfile and the JSON version file
98+
if: ${{ github.ref == 'refs/heads/main' && env.UPDATED == 'true' }}
99+
run: |
100+
sed \
101+
-e 's/%%PGBOUNCER_VERSION%%/${{ env.PGBOUNCER_VERSION }}/' \
102+
-e 's/%%DEBIAN_VERSION%%/${{ env.DEBIAN_VERSION }}/' \
103+
-e 's/%%IMAGE_RELEASE_VERSION%%/${{ env.IMAGE_RELEASE_VERSION }}/' \
104+
Dockerfile.template > Dockerfile
105+
jq -S '.PGBOUNCER_VERSION = "${{ env.PGBOUNCER_VERSION }}" | .IMAGE_RELEASE_VERSION = "${{ env.IMAGE_RELEASE_VERSION }}" | .DEBIAN_VERSION = "${{ env.DEBIAN_VERSION }}"' < .versions.json >> .versions.json.new
106+
mv .versions.json.new .versions.json
107+
-
108+
name: Temporarily disable "include administrators" branch protection
109+
if: ${{ always() && github.ref == 'refs/heads/main' && env.UPDATED == 'true' }}
110+
id: disable_include_admins
111+
uses: benjefferies/[email protected]
112+
with:
113+
access_token: ${{ secrets.REPO_GHA_PAT }}
114+
branch: main
115+
enforce_admins: false
116+
-
117+
name: Commit changes
118+
if: ${{ github.ref == 'refs/heads/main' && env.UPDATED == 'true' }}
119+
uses: EndBug/add-and-commit@v7
120+
id: commit
121+
with:
122+
author_name: EnterpriseDB Automated Updates
123+
author_email: [email protected]
124+
message: 'Automatic update'
125+
tag: v${{ env.TAG }}
126+
-
127+
name: Make sure a tag is created in case of update
128+
if: ${{ github.ref == 'refs/heads/main' && env.UPDATED == 'true' }}
129+
uses: mathieudutour/[email protected]
130+
with:
131+
github_token: ${{ secrets.REPO_GHA_PAT }}
132+
custom_tag: ${{ env.TAG }}
133+
tag_prefix: 'v'
134+
-
135+
name: Enable "include administrators" branch protection
136+
uses: benjefferies/[email protected]
137+
if: ${{ always() && github.ref == 'refs/heads/main' && env.UPDATED == 'true' }}
138+
with:
139+
access_token: ${{ secrets.REPO_GHA_PAT }}
140+
branch: main
141+
enforce_admins: ${{ steps.disable_include_admins.outputs.initial_status }}

‎.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Dockle Report
2+
dockle-report.json

‎.versions.json

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"IMAGE_RELEASE_VERSION": "1",
3+
"PGBOUNCER_VERSION": "1.17.0",
4+
"DEBIAN_VERSION": "buster-20220328-slim"
5+
}

‎CODEOWNERS

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @NiccoloFei @fcanovai @gbartolini @jbattiato @litaocdl @mnencia @sxd

‎CODE_OF_CONDUCT.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Code of Conduct
2+
3+
Cloud Native Postgres follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md). <!-- wokeignore:rule=master -->

‎Dockerfile

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
# vim:set ft=dockerfile:
2+
#
3+
# Copyright The CloudNativePG Contributors
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
# 
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
#
17+
ARG DEBIAN_VERSION=buster-20220328-slim
18+
ARG PGBOUNCER_VERSION=1.17.0
19+
20+
FROM debian:${DEBIAN_VERSION} AS build
21+
ARG PGBOUNCER_VERSION
22+
23+
# Install build dependencies.
24+
RUN set -ex; \
25+
apt-get update && apt-get upgrade -y; \
26+
apt-get install -y --no-install-recommends curl make pkg-config libevent-dev build-essential libssl-dev libudns-dev openssl ; \
27+
apt-get purge -y --auto-remove ; \
28+
rm -fr /tmp/* ; \
29+
rm -rf /var/lib/apt/lists/*
30+
31+
# build pgbouncer
32+
RUN curl -sL http://www.pgbouncer.org/downloads/files/${PGBOUNCER_VERSION}/pgbouncer-${PGBOUNCER_VERSION}.tar.gz > pgbouncer.tar.gz ; \
33+
tar xzf pgbouncer.tar.gz ; \
34+
cd pgbouncer-${PGBOUNCER_VERSION} ; \
35+
sh ./configure --without-cares --with-udns ; \
36+
make
37+
38+
39+
FROM debian:${DEBIAN_VERSION}
40+
ARG PGBOUNCER_VERSION
41+
ARG TARGETARCH
42+
43+
LABEL name="PgBouncer Container Images" \
44+
vendor="The CloudNativePG Contributors" \
45+
version="%%PGBOUNCER_VERSION%%" \
46+
release="%%IMAGE_RELEASE_VERSION%%" \
47+
summary="Container images for PgBouncer (connection pooler for PostgreSQL)." \
48+
description="This Docker image contains PgBouncer based on Debian ${DEBIAN_VERSION}."
49+
50+
RUN set -ex; \
51+
apt-get update && apt-get upgrade -y; \
52+
apt-get install -y libevent-dev libssl-dev libudns-dev libvshadow-utils findutils; \
53+
apt-get -y install postgresql ; \
54+
apt-get -y clean ; \
55+
rm -rf /var/lib/apt/lists/*; \
56+
rm -fr /tmp/* ; \
57+
adduser pgbouncer ; \
58+
mkdir -p /var/log/pgbouncer ; \
59+
mkdir -p /var/run/pgbouncer ; \
60+
chown pgbouncer:pgbouncer /var/log/pgbouncer ; \
61+
chown pgbouncer:pgbouncer /var/run/pgbouncer ;
62+
63+
COPY --from=build ["/pgbouncer-${PGBOUNCER_VERSION}/pgbouncer", "/usr/bin/"]
64+
COPY --from=build ["/pgbouncer-${PGBOUNCER_VERSION}/etc/pgbouncer.ini", "/etc/pgbouncer/pgbouncer.ini.example"]
65+
COPY --from=build ["/pgbouncer-${PGBOUNCER_VERSION}/etc/userlist.txt", "/etc/pgbouncer/userlist.txt.example"]
66+
67+
RUN touch /etc/pgbouncer/pgbouncer.ini /etc/pgbouncer/userlist.txt
68+
69+
# DoD 2.3 - remove setuid/setgid from any binary that not strictly requires it, and before doing that list them on the stdout
70+
RUN find / -not -path "/proc/*" -perm /6000 -type f -exec ls -ld {} \; -exec chmod a-s {} \; || true
71+
HEALTHCHECK --interval=5m --timeout=3s \
72+
CMD curl -f http://localhost/ || exit 1
73+
EXPOSE 6432
74+
75+
USER pgbouncer
76+
77+
COPY entrypoint.sh .
78+
79+
ENTRYPOINT ["./entrypoint.sh"]

0 commit comments

Comments
 (0)