image-build.yaml

name: bpfd-image-build

on:
  push:
    branches: [main]
    tags:
      - "v*"

  pull_request:
    paths: [".github/workflows/image-build.yaml"]

jobs:
  build-and-push-images:
    permissions:
      contents: read
      packages: write
      id-token: write # needed for signing the images with GitHub OIDC Token

    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        image:
          - registry: quay.io
            repository: bpfd
            image: bpfd
            dockerfile: ./packaging/container-deployment/Containerfile.bpfd
            context: .
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            repository: bpfd
            image: bpfctl
            dockerfile: ./packaging/container-deployment/Containerfile.bpfctl
            context: .
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            repository: bpfd
            image: bpfd-agent
            dockerfile: ./bpfd-operator/Containerfile.bpfd-agent
            context: .
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            repository: bpfd
            image: bpfd-operator
            dockerfile: ./bpfd-operator/Containerfile.bpfd-operator
            context: .
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            repository: bpfd
            image: bpfd-operator-bundle
            context: ./bpfd-operator
            dockerfile: ./bpfd-operator/Containerfile.bundle
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            repository: bpfd-userspace
            image: go-xdp-counter
            context: .
            dockerfile: ./examples/go-xdp-counter/container-deployment/Containerfile.go-xdp-counter
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            repository: bpfd-userspace
            image: go-tc-counter
            context: .
            dockerfile: ./examples/go-tc-counter/container-deployment/Containerfile.go-tc-counter
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            repository: bpfd-userspace
            image: go-tracepoint-counter
            context: .
            dockerfile: ./examples/go-tracepoint-counter/container-deployment/Containerfile.go-tracepoint-counter
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            bpf_build_wrapper: go
            repository: bpfd-bytecode
            image: go-xdp-counter
            context: ./examples/go-xdp-counter
            dockerfile: ./packaging/container-deployment/Containerfile.bytecode
            build_args: |
              PROGRAM_NAME=go-xdp-counter
              BPF_FUNCTION_NAME=xdp_stats
              PROGRAM_TYPE=xdp
              BYTECODE_FILENAME=bpf_bpfel.o
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            bpf_build_wrapper: go
            repository: bpfd-bytecode
            image: go-tc-counter
            context: ./examples/go-tc-counter
            dockerfile: ./packaging/container-deployment/Containerfile.bytecode
            build_args: |
              PROGRAM_NAME=go-tc-counter
              BPF_FUNCTION_NAME=stats
              PROGRAM_TYPE=tc
              BYTECODE_FILENAME=bpf_bpfel.o
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            bpf_build_wrapper: go
            repository: bpfd-bytecode
            image: go-tracepoint-counter
            context: ./examples/go-tracepoint-counter
            dockerfile: ./packaging/container-deployment/Containerfile.bytecode
            build_args: |
              PROGRAM_NAME=go-tracepoint-counter
              BPF_FUNCTION_NAME=tracepoint_kill_recorder
              PROGRAM_TYPE=tracepoint
              BYTECODE_FILENAME=bpf_bpfel.o
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            bpf_build_wrapper: rust
            repository: bpfd-bytecode
            image: xdp_pass
            context: ./tests/integration-test/bpf/.output
            dockerfile: ./packaging/container-deployment/Containerfile.bytecode
            build_args: |
              PROGRAM_NAME=xdp_pass
              BPF_FUNCTION_NAME=pass
              PROGRAM_TYPE=xdp
              BYTECODE_FILENAME=xdp_pass.bpf.o
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            bpf_build_wrapper: rust
            repository: bpfd-bytecode
            image: xdp_pass_private
            context: ./tests/integration-test/bpf/.output
            dockerfile: ./packaging/container-deployment/Containerfile.bytecode
            build_args: |
              PROGRAM_NAME=xdp_pass_private
              BPF_FUNCTION_NAME=pass
              PROGRAM_TYPE=xdp
              BYTECODE_FILENAME=xdp_pass.bpf.o
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            bpf_build_wrapper: rust
            repository: bpfd-bytecode
            image: tc_pass
            context: ./tests/integration-test/bpf/.output
            dockerfile: ./packaging/container-deployment/Containerfile.bytecode
            build_args: |
              PROGRAM_NAME=tc_pass
              BPF_FUNCTION_NAME=pass
              PROGRAM_TYPE=tc
              BYTECODE_FILENAME=tc_pass.bpf.o
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            bpf_build_wrapper: rust
            repository: bpfd-bytecode
            image: tracepoint
            context: ./tests/integration-test/bpf/.output
            dockerfile: ./packaging/container-deployment/Containerfile.bytecode
            build_args: |
              PROGRAM_NAME=tracepoint
              BPF_FUNCTION_NAME=enter_openat
              PROGRAM_TYPE=tracepoint
              BYTECODE_FILENAME=tp_openat.bpf.o
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            bpf_build_wrapper: rust
            repository: bpfd-bytecode
            image: uprobe
            context: ./tests/integration-test/bpf/.output
            dockerfile: ./packaging/container-deployment/Containerfile.bytecode
            build_args: |
              PROGRAM_NAME=uprobe
              BPF_FUNCTION_NAME=my_uprobe
              PROGRAM_TYPE=kprobe
              BYTECODE_FILENAME=uprobe.bpf.o
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            bpf_build_wrapper: rust
            repository: bpfd-bytecode
            image: uretprobe
            context: ./tests/integration-test/bpf/.output
            dockerfile: ./packaging/container-deployment/Containerfile.bytecode
            build_args: |
              PROGRAM_NAME=uretprobe
              BPF_FUNCTION_NAME=my_uretprobe
              PROGRAM_TYPE=kprobe
              BYTECODE_FILENAME=uprobe.bpf.o
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}

          - registry: quay.io
            bpf_build_wrapper: rust
            repository: bpfd-bytecode
            image: kprobe
            context: ./tests/integration-test/bpf/.output
            dockerfile: ./packaging/container-deployment/Containerfile.bytecode
            build_args: |
              PROGRAM_NAME=kprobe
              BPF_FUNCTION_NAME=my_kprobe
              PROGRAM_TYPE=kprobe
              BYTECODE_FILENAME=kprobe.bpf.o
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}           

          - registry: quay.io
            bpf_build_wrapper: rust
            repository: bpfd-bytecode
            image: kretprobe
            context: ./tests/integration-test/bpf/.output
            dockerfile: ./packaging/container-deployment/Containerfile.bytecode
            build_args: |
              PROGRAM_NAME=kretprobe
              BPF_FUNCTION_NAME=my_kretprobe
              PROGRAM_TYPE=kprobe
              BYTECODE_FILENAME=kprobe.bpf.o
            tags: |
              type=ref,event=branch
              type=ref,event=tag
              type=ref,event=pr
              type=sha,format=long
              # set latest tag for default branch
              type=raw,value=latest,enable={{is_default_branch}}             

          - registry: quay.io
            bpf_build_wrapper: rust
            repository: bpfd
            image: xdp-dispatcher
            context: .
            dockerfile: ./Containerfile.xdp_dispatcher_v1
            tags: |
              type=sha,format=long
              type=raw,value=v1,enable=true

          - registry: quay.io
            bpf_build_wrapper: rust
            repository: bpfd
            image: xdp-dispatcher
            context: .
            dockerfile: ./Containerfile.xdp_dispatcher_v2
            tags: |
              type=sha,format=long
              type=raw,value=v2,enable=true

    name: Build Image (${{ matrix.image.image }})
    environment: image-repositories
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-go@v4
        if: ${{ matrix.image.bpf_build_wrapper == 'go' }}
        with:
          go-version: "1.20"

      - uses: sigstore/cosign-installer@v3.1.2

      - uses: actions/checkout@v4
        if: ${{ matrix.image.bpf_build_wrapper == 'rust' }}
        with:
          repository: libbpf/libbpf
          path: libbpf

      - uses: actions-rs/toolchain@v1
        if: ${{ matrix.image.bpf_build_wrapper == 'rust' }}
        with:
          toolchain: stable
          override: true

      - name: Install libelf-dev
        if: ${{ matrix.image.bpf_build_wrapper == 'rust' || matrix.image.bpf_build_wrapper == 'go' }}
        run: |
          sudo apt-get update
          sudo apt-get install -y linux-headers-`uname -r` clang lldb lld libelf-dev gcc-multilib libbpf-dev

      - name: Build rust wrapped eBPF
        if: ${{ matrix.image.bpf_build_wrapper == 'rust' }}
        run: |
          cargo xtask build-ebpf --libbpf-dir ./libbpf
      
      - name: Install bpf2go
        if: ${{ matrix.image.bpf_build_wrapper == 'go' }}
        run: |
          go install github.com/cilium/ebpf/cmd/bpf2go@v0.11.0

      - name: Generate go wrapped eBPF
        if: ${{ matrix.image.bpf_build_wrapper == 'go' }}
        run: |
          cd examples && make generate

      - name: Generate olm bundle on disk
        if: ${{ matrix.image.image == 'bpfd-operator-bundle' }}
        run: |
          cd bpfd-operator && make bundle

      - name: Login to quay.io/bpfd
        uses: redhat-actions/podman-login@v1
        if: ${{ github.event_name == 'push' && matrix.image.repository == 'bpfd'}}
        with:
          registry: ${{ matrix.image.registry }}
          username: ${{ secrets.BPFD_USERNAME }}
          password: ${{ secrets.BPFD_ROBOT_TOKEN }}

      - name: Login to quay.io/bpfd-userspace
        uses: redhat-actions/podman-login@v1
        if: ${{ github.event_name == 'push' && matrix.image.repository == 'bpfd-userspace'}}
        with:
          registry: ${{ matrix.image.registry }}
          username: ${{ secrets.BPFD_USERSPACE_USERNAME }}
          password: ${{ secrets.BPFD_USERSPACE_ROBOT_TOKEN }}

      - name: Login to quay.io/bpfd-bytecode
        uses: redhat-actions/podman-login@v1
        if: ${{ github.event_name == 'push' && matrix.image.repository == 'bpfd-bytecode' }}
        with:
          registry: ${{ matrix.image.registry }}
          username: ${{ secrets.BPFD_BYTECODE_USERNAME }}
          password: ${{ secrets.BPFD_BYTECODE_ROBOT_TOKEN }}

      - name: Extract metadata (tags, labels) for image
        id: meta
        uses: docker/metadata-action@v5.0.0
        with:
          images: ${{ matrix.image.registry }}/${{ matrix.image.repository }}/${{ matrix.image.image }}
          tags: ${{ matrix.image.tags }}

      - name: Build image
        id: build-image
        uses: redhat-actions/buildah-build@v2
        with:
          image: ${{ matrix.image.image }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          containerfiles: ${{ matrix.image.dockerfile }}
          build-args: ${{ matrix.image.build_args }}
          context: ${{ matrix.image.context }}

      - name: Push to registry
        id: push-image
        uses: redhat-actions/push-to-registry@v2
        if: ${{ github.event_name == 'push' }}
        with:
          tags: ${{ steps.meta.outputs.tags }}

      - name: Sign the images with GitHub OIDC Token
        if: ${{ github.event_name == 'push' }}
        run: |
          readarray -t tags <<<"${{ steps.meta.outputs.tags }}"
          for tag in ${tags[@]}; do
            cosign sign -y "${tag}@${{ steps.push-image.outputs.digest }}"
          done