Rename Helm chart and Docker image and move to GHCR (#233)

This change does a few things, none of these are breaking.

It changes the registry from Docker Hub to GHCR, as we dont have the
same rate limiting issues with unauthenticated pulls.

It changes the release process to push the Helm chart as an OCI artifact
removing the need for GH pages.

It renames both the image and chart from kubernetes-operator to
netbird-operator. This name is cleaner and easier for people to
understand in a sea of Helm charts. Funnily enough this is not a
breaking change as the release name is used and not the chart name. So
in place upgrades just work.

Fixes #207

Signed-off-by: Philip Laine <philip.laine@gmail.com>

.github/workflows/helm.yaml

@@ -8,4 +8,4 @@ jobs:
       - name: Clone the code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
       - name: Lint Helm Chart
-        run: helm lint ./helm/kubernetes-operator
+        run: helm lint ./charts/netbird-operator

.github/workflows/release.yaml

@@ -3,15 +3,16 @@ on:
   push:
     tags:
       - "v*"
-    branches:
-      - main
+permissions:
+  contents: read
+  packages: write
+  id-token: write
+defaults:
+  run:
+    shell: bash
 jobs:
-  docker:
+  release:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
     steps:
       - name: Clone the code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
@@ -19,23 +20,41 @@ jobs:
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c #v6.4.0
         with:
           go-version-file: go.mod
+      - name: Set up Docker
+        uses: docker/setup-docker-action@b2189fbf2a6592b51fee7cdd93ee2bfaeba733db #v5.1.0
+        with:
+          daemon-config: |
+            {
+              "features": {
+                "containerd-snapshotter": true
+              }
+            }
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd #v4.0.0
-      - name: Login to Docker Hub
+        with:
+          driver: docker
+      - name: Login to GitHub Container Registry
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 #v4.1.0
         with:
-          username: ${{ secrets.DOCKER_USER }}
-          password: ${{ secrets.DOCKER_TOKEN }}
-      - name: Build image
-        id: build
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Prepare versions
+        id: prep
         run: |
+          IMG_TAG="${GITHUB_REF_NAME}"
           if [[ "${{ github.ref_type }}" == "tag" ]]; then
-            IMG_TAG="${GITHUB_REF_NAME#v}"
+            HELM_VERSION=${GITHUB_REF_NAME#v}
           else
-            IMG_TAG="${GITHUB_SHA::7}"
+            HELM_VERSION="0.0.0-${GITHUB_REF_NAME}"
           fi
-          IMG=$(make build-image-multiarch) || exit 1
-          echo "IMG=${IMG}" >> $GITHUB_OUTPUT
-      - name: Push image
+          echo "IMG_TAG=${IMG_TAG}" >> $GITHUB_OUTPUT
+          echo "HELM_VERSION=${HELM_VERSION}" >> $GITHUB_OUTPUT
+      - name: Build and push image
         run: |
-          docker push ${{ steps.build.outputs.IMG }}
+          IMG_REF=$(make build-image-multiarch IMG_REPOSITORY=${{ github.repository_owner }}/netbird-operator IMG_TAG=${{ steps.prep.outputs.IMG_TAG }}) || exit 1
+          docker push ${IMG_REF}
+      - name: Build and push Helm chart
+        run: |
+          helm package --app-version ${{ steps.prep.outputs.IMG_TAG }} --version ${{ steps.prep.outputs.HELM_VERSION }} charts/netbird-operator
+          helm push netbird-operator-${{ steps.prep.outputs.HELM_VERSION }}.tgz oci://ghcr.io/${{ github.repository_owner }}/helm-charts

Dockerfile

@@ -2,10 +2,10 @@ FROM gcr.io/distroless/static:nonroot
 ARG TARGETOS
 ARG TARGETARCH
 LABEL org.opencontainers.image.title="NetBird Operator" \
-      org.opencontainers.image.description="Kubernetes operator for NetBird." \
+      org.opencontainers.image.description="Kubernetes operator for NetBird" \
       org.opencontainers.image.source="https://github.com/netbirdio/kubernetes-operator" \
       org.opencontainers.image.vendor="NetBird" \
       org.opencontainers.image.licenses="BSD-3-Clause"
-COPY bin/${TARGETOS}-${TARGETARCH}/netbird-operator .
+COPY bin/${TARGETOS}-${TARGETARCH}/netbird-operator /usr/local/bin/
 USER 65532:65532
-ENTRYPOINT ["/netbird-operator"]
+ENTRYPOINT ["netbird-operator"]

Makefile

@@ -10,13 +10,13 @@ else
 GOBIN = $(shell go env GOBIN)
 endif
 
-IMG_REGISTRY ?= docker.io
-IMG_REPOSITORY ?= netbirdio/kubernetes-operator
+IMG_REGISTRY ?= ghcr.io
+IMG_REPOSITORY ?= netbirdio/netbird-operator
 IMG_TAG ?= dev
 IMG_REF := $(IMG_REGISTRY)/$(IMG_REPOSITORY):$(IMG_TAG)
 
 .PHONY: generate
-generate: api/v1/zz_generated.deepcopy.go api/v1alpha1/zz_generated.deepcopy.go pkg/applyconfigurations helm/kubernetes-operator/crds docs/api-reference.md
+generate: api/v1/zz_generated.deepcopy.go api/v1alpha1/zz_generated.deepcopy.go pkg/applyconfigurations charts/netbird-operator/crds docs/api-reference.md
 
 api/v1/zz_generated.deepcopy.go api/v1alpha1/zz_generated.deepcopy.go: $(shell find api -not -name 'zz_generated*') hack/boilerplate.go.txt
 	@go tool controller-gen object:headerFile="hack/boilerplate.go.txt" paths="./..."
@@ -25,9 +25,9 @@ pkg/applyconfigurations: $(shell find api -not -name 'zz_generated*') hack/boile
 	@go tool controller-gen applyconfiguration:headerFile="hack/boilerplate.go.txt" object:headerFile="hack/boilerplate.go.txt" paths="./..."
 	@touch pkg/applyconfigurations
 
-helm/kubernetes-operator/crds: $(shell find api)
-	@go tool controller-gen crd paths="./..." output:crd:artifacts:config=helm/kubernetes-operator/crds
-	@touch helm/kubernetes-operator/crds
+charts/netbird-operator/crds: $(shell find api)
+	@go tool controller-gen crd paths="./..." output:crd:artifacts:config=charts/netbird-operator/crds
+	@touch charts/netbird-operator/crds
 
 docs/api-reference.md: $(shell find api) docs/.crd-ref-docs.yaml
 	@go tool crd-ref-docs --log-level error --output-path docs/api-reference.md --renderer markdown --source-path api/v1alpha1 --config docs/.crd-ref-docs.yaml
@@ -51,29 +51,29 @@ bin/linux-%/netbird-operator: $(shell find api cmd internal pkg) go.mod go.sum
 
 .PHONY: build-image
 build-image: build
-	@docker buildx build -t ${IMG_REF} .
+	@DOCKER_BUILDKIT=1 docker build -t ${IMG_REF} .
 	@echo ${IMG_REF}
 
 .PHONY: build-image-multiarch
 build-image-multiarch: generate bin/linux-amd64/netbird-operator bin/linux-arm64/netbird-operator
-	@docker buildx build --platform linux/amd64,linux/arm64 -t ${IMG_REF} .
+	@DOCKER_BUILDKIT=1 docker build --platform linux/amd64,linux/arm64 -t ${IMG_REF} .
 	@echo ${IMG_REF}
 
 ## Generate a consolidated YAML with CRDs and deployment.
 .PHONY: build-installer
 build-installer: generate
 	mkdir -p manifests
-	helm template --include-crds kubernetes-operator helm/kubernetes-operator > manifests/install.yaml
+	helm template --include-crds netbird-operator charts/netbird-operator > manifests/install.yaml
 
 ##@ Deployment
 
 .PHONY: install
 install: generate
-	kubectl apply --server-side -f helm/kubernetes-operator/crds
+	kubectl apply --server-side -f charts/netbird-operator/crds
 
 .PHONY: uninstall
 uninstall:
-	kubectl delete -f helm/kubernetes-operator/crds
+	kubectl delete -f charts/netbird-operator/crds
 
 run: install
 	kubectl create namespace netbird --dry-run=client -o yaml | kubectl apply -f -

charts/netbird-operator/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: netbird-operator
+description: Kubernetes operator for NetBird
+type: application
+version: "0.0.0"
+appVersion: ""

charts/netbird-operator/templates/_helpers.tpl

@@ -1,7 +1,7 @@
 {{/*
 Expand the name of the chart.
 */}}
-{{- define "kubernetes-operator.name" -}}
+{{- define "netbird-operator.name" -}}
 {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
@@ -10,7 +10,7 @@ Create a default fully qualified app name.
 We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
 If release name contains chart name it will be used as a full name.
 */}}
-{{- define "kubernetes-operator.fullname" -}}
+{{- define "netbird-operator.fullname" -}}
 {{- if .Values.fullnameOverride }}
 {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
 {{- else }}
@@ -26,16 +26,16 @@ If release name contains chart name it will be used as a full name.
 {{/*
 Create chart name and version as used by the chart label.
 */}}
-{{- define "kubernetes-operator.chart" -}}
+{{- define "netbird-operator.chart" -}}
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
 {{/*
 Common labels
 */}}
-{{- define "kubernetes-operator.labels" -}}
-helm.sh/chart: {{ include "kubernetes-operator.chart" . }}
-{{ include "kubernetes-operator.selectorLabels" . }}
+{{- define "netbird-operator.labels" -}}
+helm.sh/chart: {{ include "netbird-operator.chart" . }}
+{{ include "netbird-operator.selectorLabels" . }}
 {{- if .Chart.AppVersion }}
 app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- end }}
@@ -50,17 +50,17 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{/*
 Selector labels
 */}}
-{{- define "kubernetes-operator.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "kubernetes-operator.name" . }}
+{{- define "netbird-operator.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "netbird-operator.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
 {{/*
 Create the name of the service account to use
 */}}
-{{- define "kubernetes-operator.serviceAccountName" -}}
+{{- define "netbird-operator.serviceAccountName" -}}
 {{- if .Values.operator.serviceAccount.create }}
-{{- default (include "kubernetes-operator.fullname" .) .Values.operator.serviceAccount.name }}
+{{- default (include "netbird-operator.fullname" .) .Values.operator.serviceAccount.name }}
 {{- else }}
 {{- default "default" .Values.operator.serviceAccount.name }}
 {{- end }}
@@ -70,23 +70,23 @@ Create the name of the service account to use
 {{/*
 Create the name of the webhook service
 */}}
-{{- define "kubernetes-operator.webhookService" -}}
-{{- printf "%s-webhook-service" (include "kubernetes-operator.fullname" .) -}}
+{{- define "netbird-operator.webhookService" -}}
+{{- printf "%s-webhook-service" (include "netbird-operator.fullname" .) -}}
 {{- end -}}
 
 {{/*
 Create the name of the webhook cert secret
 */}}
-{{- define "kubernetes-operator.webhookCertSecret" -}}
-{{- printf "%s-tls" (include "kubernetes-operator.fullname" .) -}}
+{{- define "netbird-operator.webhookCertSecret" -}}
+{{- printf "%s-tls" (include "netbird-operator.fullname" .) -}}
 {{- end -}}
 
 {{/*
 Generate certificates for webhook
 */}}
-{{- define "kubernetes-operator.webhookCerts" -}}
-{{- $serviceName := (include "kubernetes-operator.webhookService" .) -}}
-{{- $secretName := (include "kubernetes-operator.webhookCertSecret" .) -}}
+{{- define "netbird-operator.webhookCerts" -}}
+{{- $serviceName := (include "netbird-operator.webhookService" .) -}}
+{{- $secretName := (include "netbird-operator.webhookCertSecret" .) -}}
 {{- $secret := lookup "v1" "Secret" .Release.Namespace $secretName -}}
 {{- if (and .Values.webhook.tls.caCert .Values.webhook.tls.cert .Values.webhook.tls.key) -}}
 caCert: {{ .Values.webhook.tls.caCert | b64enc }}
@@ -98,10 +98,10 @@ clientCert: {{ index $secret.data "tls.crt" }}
 clientKey: {{ index $secret.data "tls.key" }}
 {{- else -}}
 {{- $altNames := list (printf "%s.%s" $serviceName .Release.Namespace) (printf "%s.%s.svc" $serviceName .Release.Namespace) (printf "%s.%s.%s" $serviceName .Release.Namespace .Values.cluster.dns) -}}
-{{- $ca := genCA "kubernetes-operator-ca" 3650 -}}
-{{- $cert := genSignedCert (include "kubernetes-operator.fullname" .) nil $altNames 3650 $ca -}}
+{{- $ca := genCA "netbird-operator-ca" 3650 -}}
+{{- $cert := genSignedCert (include "netbird-operator.fullname" .) nil $altNames 3650 $ca -}}
 caCert: {{ $ca.Cert | b64enc }}
 clientCert: {{ $cert.Cert | b64enc }}
 clientKey: {{ $cert.Key | b64enc }}
 {{- end -}}
-{{- end -}}
+{{- end -}}

charts/netbird-operator/templates/deployment.yaml

@@ -1,15 +1,15 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "kubernetes-operator.fullname" . }}
+  name: {{ include "netbird-operator.fullname" . }}
   labels:
     app.kubernetes.io/component: operator
-    {{- include "kubernetes-operator.labels" . | nindent 4 }}
+    {{- include "netbird-operator.labels" . | nindent 4 }}
 spec:
   replicas: {{ .Values.operator.replicaCount }}
   selector:
     matchLabels:
-      {{- include "kubernetes-operator.selectorLabels" . | nindent 6 }}
+      {{- include "netbird-operator.selectorLabels" . | nindent 6 }}
   template:
     metadata:
       {{- with .Values.operator.podAnnotations }}
@@ -18,7 +18,7 @@ spec:
       {{- end }}
       labels:
         app.kubernetes.io/component: operator
-        {{- include "kubernetes-operator.labels" . | nindent 8 }}
+        {{- include "netbird-operator.labels" . | nindent 8 }}
         {{- with .Values.operator.podLabels }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
@@ -27,7 +27,7 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      serviceAccountName: {{ include "kubernetes-operator.serviceAccountName" . }}
+      serviceAccountName: {{ include "netbird-operator.serviceAccountName" . }}
       securityContext:
         {{- toYaml .Values.operator.podSecurityContext | nindent 8 }}
       containers:
@@ -36,8 +36,6 @@ spec:
             {{- toYaml .Values.operator.securityContext | nindent 12 }}
           image: "{{ .Values.operator.image.registry }}/{{ .Values.operator.image.repository }}:{{ .Values.operator.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.operator.image.pullPolicy }}
-          command:
-          - /manager
           args:
           {{- if .Values.operator.metrics.enabled }}
           - --metrics-bind-address=:{{ .Values.operator.metrics.port}}
@@ -104,7 +102,7 @@ spec:
                   name: {{ .Values.netbirdAPI.keyFromSecret.name }}
                   key: {{ .Values.netbirdAPI.keyFromSecret.key }}
                   {{- else }}
-                  name: {{ include "kubernetes-operator.fullname" . }}
+                  name: {{ include "netbird-operator.fullname" . }}
                   key: NB_API_KEY
                   {{- end }}
           {{- end }}
@@ -131,7 +129,7 @@ spec:
       - name: webhook-certs
         secret:
           defaultMode: 420
-          secretName: {{ template "kubernetes-operator.webhookCertSecret" . }}
+          secretName: {{ template "netbird-operator.webhookCertSecret" . }}
       {{- with .Values.operator.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}

charts/netbird-operator/templates/gateway-api.yaml

@@ -4,7 +4,7 @@ kind: GatewayClass
 metadata:
   name: netbird-private
   labels:
-    {{- include "kubernetes-operator.labels" . | nindent 4 }}
+    {{- include "netbird-operator.labels" . | nindent 4 }}
 spec:
   controllerName: "gateway.netbird.io/controller"
 ---
@@ -13,7 +13,7 @@ kind: GatewayClass
 metadata:
   name: netbird-public
   labels:
-    {{- include "kubernetes-operator.labels" . | nindent 4 }}
+    {{- include "netbird-operator.labels" . | nindent 4 }}
 spec:
   controllerName: "gateway.netbird.io/controller"
 {{- end }}

charts/netbird-operator/templates/nbpolicies.yaml

@@ -7,7 +7,7 @@ metadata:
     - netbird.io/cleanup
   labels:
     app.kubernetes.io/component: operator
-    {{- include "kubernetes-operator.labels" $ | nindent 4 }}
+    {{- include "netbird-operator.labels" $ | nindent 4 }}
   annotations:
     helm.sh/resource-policy: keep
   name: {{ $k }}
@@ -29,4 +29,4 @@ spec:
   {{- if hasKey $v "bidirectional" }}
   bidirectional: {{ $v.bidirectional }}
   {{- end }}
-{{- end }}
+{{- end }}