mirror of
https://github.com/falcosecurity/falco.git
synced 2026-03-19 19:22:05 +00:00
cb51522423
When MUSL_OPTIMIZED_BUILD is specified, falco is statically linked under musl, and can't dlopen() files: see https://inbox.vuxu.org/musl/20200423162406.GV11469@brightrain.aerifal.cx/T/ So skip listing/loading/testing plugins when MUSL_OPTIMIZED_BUILD is specified. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
753 lines
28 KiB
YAML
753 lines
28 KiB
YAML
version: 2
|
|
jobs:
|
|
# Build a statically linked Falco release binary using musl
|
|
# This build is 100% static, there are no host dependencies
|
|
"build/musl":
|
|
docker:
|
|
- image: alpine:3.12
|
|
steps:
|
|
- checkout:
|
|
path: /source-static/falco
|
|
- run:
|
|
name: Update base image
|
|
command: apk update
|
|
- run:
|
|
name: Install build dependencies
|
|
command: apk add g++ gcc cmake cmake make git bash perl linux-headers autoconf automake m4 libtool elfutils-dev libelf-static patch binutils
|
|
- run:
|
|
name: Prepare project
|
|
command: |
|
|
mkdir -p /build-static/release
|
|
cd /build-static/release
|
|
cmake -DCPACK_GENERATOR=TGZ -DBUILD_BPF=Off -DBUILD_DRIVER=Off -DCMAKE_BUILD_TYPE=Release -DUSE_BUNDLED_DEPS=On -DMUSL_OPTIMIZED_BUILD=On -DFALCO_ETC_DIR=/etc/falco /source-static/falco
|
|
- run:
|
|
name: Build
|
|
command: |
|
|
cd /build-static/release
|
|
make -j4 all
|
|
- run:
|
|
name: Package
|
|
command: |
|
|
cd /build-static/release
|
|
make -j4 package
|
|
- run:
|
|
name: Run unit tests
|
|
command: |
|
|
cd /build-static/release
|
|
make tests
|
|
- run:
|
|
name: Prepare artifacts
|
|
command: |
|
|
mkdir -p /tmp/packages
|
|
cp /build-static/release/*.tar.gz /tmp/packages
|
|
- store_artifacts:
|
|
path: /tmp/packages
|
|
destination: /packages
|
|
- persist_to_workspace:
|
|
root: /
|
|
paths:
|
|
- build-static/release
|
|
- source-static
|
|
# Build the minimal Falco
|
|
# This build only contains the Falco engine and the basic input/output.
|
|
"build/minimal":
|
|
docker:
|
|
- image: ubuntu:focal
|
|
steps:
|
|
- checkout
|
|
- run:
|
|
name: Update base image
|
|
command: apt update -y
|
|
- run:
|
|
name: Install dependencies
|
|
command: DEBIAN_FRONTEND=noninteractive apt install libjq-dev libyaml-cpp-dev libelf-dev cmake build-essential git -y
|
|
- run:
|
|
name: Prepare project
|
|
command: |
|
|
mkdir build-minimal
|
|
pushd build-minimal
|
|
cmake -DMINIMAL_BUILD=On -DBUILD_BPF=Off -DBUILD_DRIVER=Off -DCMAKE_BUILD_TYPE=Release ..
|
|
popd
|
|
- run:
|
|
name: Build
|
|
command: |
|
|
pushd build-minimal
|
|
make -j4 all
|
|
popd
|
|
- run:
|
|
name: Run unit tests
|
|
command: |
|
|
pushd build-minimal
|
|
make tests
|
|
popd
|
|
# Build using ubuntu LTS
|
|
# This build is dynamic, most dependencies are taken from the OS
|
|
"build/ubuntu-focal":
|
|
docker:
|
|
- image: ubuntu:focal
|
|
steps:
|
|
- checkout
|
|
- run:
|
|
name: Update base image
|
|
command: apt update -y
|
|
- run:
|
|
name: Install dependencies
|
|
command: DEBIAN_FRONTEND=noninteractive apt install libssl-dev libyaml-dev libc-ares-dev libprotobuf-dev protobuf-compiler libjq-dev libyaml-cpp-dev libgrpc++-dev protobuf-compiler-grpc rpm libelf-dev cmake build-essential libcurl4-openssl-dev linux-headers-generic clang llvm git -y
|
|
- run:
|
|
name: Prepare project
|
|
command: |
|
|
mkdir build
|
|
pushd build
|
|
cmake -DBUILD_BPF=On ..
|
|
popd
|
|
- run:
|
|
name: Build
|
|
command: |
|
|
pushd build
|
|
KERNELDIR=/lib/modules/$(ls /lib/modules)/build make -j4 all
|
|
popd
|
|
- run:
|
|
name: Run unit tests
|
|
command: |
|
|
pushd build
|
|
make tests
|
|
popd
|
|
# Debug build using ubuntu LTS
|
|
# This build is dynamic, most dependencies are taken from the OS
|
|
"build/ubuntu-focal-debug":
|
|
docker:
|
|
- image: ubuntu:focal
|
|
steps:
|
|
- checkout
|
|
- run:
|
|
name: Update base image
|
|
command: apt update -y
|
|
- run:
|
|
name: Install dependencies
|
|
command: DEBIAN_FRONTEND=noninteractive apt install libssl-dev libyaml-dev libc-ares-dev libprotobuf-dev protobuf-compiler libjq-dev libyaml-cpp-dev libgrpc++-dev protobuf-compiler-grpc rpm libelf-dev cmake build-essential libcurl4-openssl-dev linux-headers-generic clang llvm git -y
|
|
- run:
|
|
name: Prepare project
|
|
command: |
|
|
mkdir build
|
|
pushd build
|
|
cmake -DCMAKE_BUILD_TYPE=debug -DBUILD_BPF=On ..
|
|
popd
|
|
- run:
|
|
name: Build
|
|
command: |
|
|
pushd build
|
|
KERNELDIR=/lib/modules/$(ls /lib/modules)/build make -j4 all
|
|
popd
|
|
- run:
|
|
name: Run unit tests
|
|
command: |
|
|
pushd build
|
|
make tests
|
|
popd
|
|
# Build using Ubuntu Bionic Beaver (18.04)
|
|
# This build is static, dependencies are bundled in the Falco binary
|
|
"build/ubuntu-bionic":
|
|
docker:
|
|
- image: ubuntu:bionic
|
|
steps:
|
|
- checkout
|
|
- run:
|
|
name: Update base image
|
|
command: apt update -y
|
|
- run:
|
|
name: Install dependencies
|
|
command: DEBIAN_FRONTEND=noninteractive apt install cmake build-essential clang llvm git linux-headers-generic pkg-config autoconf libtool libelf-dev -y
|
|
- run:
|
|
name: Prepare project
|
|
command: |
|
|
mkdir build
|
|
pushd build
|
|
cmake -DBUILD_BPF=On -DUSE_BUNDLED_DEPS=On ..
|
|
popd
|
|
- run:
|
|
name: Build
|
|
command: |
|
|
pushd build
|
|
KERNELDIR=/lib/modules/$(ls /lib/modules)/build make -j4 all
|
|
popd
|
|
- run:
|
|
name: Run unit tests
|
|
command: |
|
|
pushd build
|
|
make tests
|
|
popd
|
|
# Build using CentOS 8
|
|
# This build is static, dependencies are bundled in the Falco binary
|
|
"build/centos8":
|
|
docker:
|
|
- image: centos:8
|
|
steps:
|
|
- checkout
|
|
- run:
|
|
name: Update base image
|
|
command: dnf update -y
|
|
- run:
|
|
name: Install dependencies
|
|
command: dnf install gcc gcc-c++ git make cmake autoconf automake pkg-config patch libtool elfutils-libelf-devel diffutils kernel-devel kernel-headers kernel-core clang llvm which -y
|
|
- run:
|
|
name: Prepare project
|
|
command: |
|
|
mkdir build
|
|
pushd build
|
|
cmake -DBUILD_BPF=On -DUSE_BUNDLED_DEPS=On ..
|
|
popd
|
|
- run:
|
|
name: Build
|
|
command: |
|
|
pushd build
|
|
KERNELDIR=/lib/modules/$(ls /lib/modules)/build make -j4 all
|
|
popd
|
|
- run:
|
|
name: Run unit tests
|
|
command: |
|
|
pushd build
|
|
make tests
|
|
popd
|
|
# Build using our own builder base image using centos 7
|
|
# This build is static, dependencies are bundled in the Falco binary
|
|
"build/centos7":
|
|
docker:
|
|
- image: falcosecurity/falco-builder:latest
|
|
environment:
|
|
BUILD_TYPE: "release"
|
|
steps:
|
|
- checkout:
|
|
path: /source/falco
|
|
- run:
|
|
name: Prepare project
|
|
command: /usr/bin/entrypoint cmake
|
|
- run:
|
|
name: Build
|
|
command: /usr/bin/entrypoint all
|
|
- run:
|
|
name: Run unit tests
|
|
command: /usr/bin/entrypoint tests
|
|
- run:
|
|
name: Build packages
|
|
command: /usr/bin/entrypoint package
|
|
- persist_to_workspace:
|
|
root: /
|
|
paths:
|
|
- build/release
|
|
- source
|
|
- run:
|
|
name: Prepare artifacts
|
|
command: |
|
|
mkdir -p /tmp/packages
|
|
cp /build/release/*.deb /tmp/packages
|
|
cp /build/release/*.tar.gz /tmp/packages
|
|
cp /build/release/*.rpm /tmp/packages
|
|
- store_artifacts:
|
|
path: /tmp/packages
|
|
destination: /packages
|
|
# Debug build using our own builder base image using centos 7
|
|
# This build is static, dependencies are bundled in the Falco binary
|
|
"build/centos7-debug":
|
|
docker:
|
|
- image: falcosecurity/falco-builder:latest
|
|
environment:
|
|
BUILD_TYPE: "debug"
|
|
steps:
|
|
- checkout:
|
|
path: /source/falco
|
|
- run:
|
|
name: Prepare project
|
|
command: /usr/bin/entrypoint cmake
|
|
- run:
|
|
name: Build
|
|
command: /usr/bin/entrypoint all
|
|
- run:
|
|
name: Run unit tests
|
|
command: /usr/bin/entrypoint tests
|
|
- run:
|
|
name: Build packages
|
|
command: /usr/bin/entrypoint package
|
|
# Execute integration tests based on the build results coming from the "build/centos7" job
|
|
"tests/integration":
|
|
docker:
|
|
- image: falcosecurity/falco-tester:latest
|
|
environment:
|
|
SOURCE_DIR: "/source"
|
|
BUILD_DIR: "/build"
|
|
BUILD_TYPE: "release"
|
|
steps:
|
|
- setup_remote_docker
|
|
- attach_workspace:
|
|
at: /
|
|
- run:
|
|
name: Execute integration tests
|
|
command: /usr/bin/entrypoint test
|
|
- store_test_results:
|
|
path: /build/release/integration-tests-xunit
|
|
"tests/integration-static":
|
|
docker:
|
|
- image: falcosecurity/falco-tester:latest
|
|
environment:
|
|
SOURCE_DIR: "/source-static"
|
|
BUILD_DIR: "/build-static"
|
|
BUILD_TYPE: "release"
|
|
SKIP_PACKAGES_TESTS: "true"
|
|
SKIP_PLUGINS_TESTS: "true"
|
|
steps:
|
|
- setup_remote_docker
|
|
- attach_workspace:
|
|
at: /
|
|
- run:
|
|
name: Execute integration tests
|
|
command: /usr/bin/entrypoint test
|
|
- store_test_results:
|
|
path: /build-static/release/integration-tests-xunit
|
|
"tests/driver-loader/integration":
|
|
machine:
|
|
image: ubuntu-2004:202107-02
|
|
steps:
|
|
- attach_workspace:
|
|
at: /tmp/ws
|
|
- run:
|
|
name: Execute driver-loader integration tests
|
|
command: /tmp/ws/source/falco/test/driver-loader/run_test.sh /tmp/ws/build/release/
|
|
# Code quality
|
|
"quality/static-analysis":
|
|
docker:
|
|
- image: falcosecurity/falco-builder:latest
|
|
environment:
|
|
BUILD_TYPE: "release"
|
|
steps:
|
|
- run:
|
|
name: Install cppcheck
|
|
command: |
|
|
yum update -y
|
|
yum install epel-release -y
|
|
yum install cppcheck cppcheck-htmlreport -y
|
|
- checkout:
|
|
path: /source/falco
|
|
- run:
|
|
name: Prepare project
|
|
command: /usr/bin/entrypoint cmake
|
|
- run:
|
|
name: cppcheck
|
|
command: /usr/bin/entrypoint cppcheck
|
|
- run:
|
|
name: cppcheck html report
|
|
command: /usr/bin/entrypoint cppcheck_htmlreport
|
|
- store_artifacts:
|
|
path: /build/release/static-analysis-reports
|
|
destination: /static-analysis-reports
|
|
# Sign rpm packages
|
|
"rpm/sign":
|
|
docker:
|
|
- image: falcosecurity/falco-builder:latest
|
|
steps:
|
|
- attach_workspace:
|
|
at: /
|
|
- run:
|
|
name: Install rpmsign
|
|
command: |
|
|
yum update -y
|
|
yum install rpm-sign -y
|
|
- run:
|
|
name: Sign rpm
|
|
command: |
|
|
echo "%_signature gpg" > ~/.rpmmacros
|
|
echo "%_gpg_name Falcosecurity Package Signing" >> ~/.rpmmacros
|
|
cd /build/release/
|
|
echo '#!/usr/bin/expect -f' > sign
|
|
echo 'spawn rpmsign --addsign {*}$argv' >> sign
|
|
echo 'expect -exact "Enter pass phrase: "' >> sign
|
|
echo 'send -- "\n"' >> sign
|
|
echo 'expect eof' >> sign
|
|
chmod +x sign
|
|
echo $GPG_KEY | base64 -d | gpg --import
|
|
./sign *.rpm
|
|
test "$(rpm -qpi *.rpm | awk '/Signature/' | grep -i none | wc -l)" -eq 0
|
|
- persist_to_workspace:
|
|
root: /
|
|
paths:
|
|
- build/release/*.rpm
|
|
# Publish the dev packages
|
|
"publish/packages-dev":
|
|
docker:
|
|
- image: docker.io/centos:7
|
|
steps:
|
|
- attach_workspace:
|
|
at: /
|
|
- run:
|
|
name: Setup
|
|
command: |
|
|
yum install epel-release -y
|
|
yum update -y
|
|
yum install createrepo gpg python python-pip -y
|
|
pip install awscli==1.19.47
|
|
echo $GPG_KEY | base64 -d | gpg --import
|
|
- run:
|
|
name: Publish rpm-dev
|
|
command: |
|
|
FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
|
/source/falco/scripts/publish-rpm -f /build/release/falco-${FALCO_VERSION}-x86_64.rpm -r rpm-dev
|
|
- run:
|
|
name: Publish bin-dev
|
|
command: |
|
|
FALCO_VERSION=$(cat /build-static/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
|
/source/falco/scripts/publish-bin -f /build-static/release/falco-${FALCO_VERSION}-x86_64.tar.gz -r bin-dev -a x86_64
|
|
"publish/packages-deb-dev":
|
|
docker:
|
|
- image: docker.io/debian:stable
|
|
steps:
|
|
- attach_workspace:
|
|
at: /
|
|
- run:
|
|
name: Setup
|
|
command: |
|
|
apt update -y
|
|
apt-get install apt-utils bzip2 gpg python python3-pip -y
|
|
pip install awscli
|
|
echo $GPG_KEY | base64 -d | gpg --import
|
|
- run:
|
|
name: Publish deb-dev
|
|
command: |
|
|
FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
|
/source/falco/scripts/publish-deb -f /build/release/falco-${FALCO_VERSION}-x86_64.deb -r deb-dev
|
|
# Publish docker packages
|
|
"publish/docker-dev":
|
|
docker:
|
|
- image: docker:stable
|
|
steps:
|
|
- attach_workspace:
|
|
at: /
|
|
- checkout
|
|
- setup_remote_docker
|
|
- run:
|
|
name: Build and publish no-driver-dev
|
|
command: |
|
|
FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
|
docker build --build-arg VERSION_BUCKET=bin-dev --build-arg FALCO_VERSION=${FALCO_VERSION} -t falcosecurity/falco-no-driver:master docker/no-driver
|
|
docker tag falcosecurity/falco-no-driver:master falcosecurity/falco:master-slim
|
|
echo ${DOCKERHUB_SECRET} | docker login -u ${DOCKERHUB_USER} --password-stdin
|
|
docker push falcosecurity/falco-no-driver:master
|
|
docker push falcosecurity/falco:master-slim
|
|
- run:
|
|
name: Build and publish dev
|
|
command: |
|
|
FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
|
docker build --build-arg VERSION_BUCKET=deb-dev --build-arg FALCO_VERSION=${FALCO_VERSION} -t falcosecurity/falco:master docker/falco
|
|
echo ${DOCKERHUB_SECRET} | docker login -u ${DOCKERHUB_USER} --password-stdin
|
|
docker push falcosecurity/falco:master
|
|
- run:
|
|
name: Build and publish dev falco-driver-loader-dev
|
|
command: |
|
|
docker build --build-arg FALCO_IMAGE_TAG=master -t falcosecurity/falco-driver-loader:master docker/driver-loader
|
|
echo ${DOCKERHUB_SECRET} | docker login -u ${DOCKERHUB_USER} --password-stdin
|
|
docker push falcosecurity/falco-driver-loader:master
|
|
# Publish container images to AWS ECR Public
|
|
"publish/container-images-aws-dev":
|
|
docker:
|
|
- image: docker:stable
|
|
steps:
|
|
- attach_workspace:
|
|
at: /
|
|
- checkout
|
|
- setup_remote_docker
|
|
- run:
|
|
name: Build and publish no-driver (dev) to AWS
|
|
command: |
|
|
apk update
|
|
apk add --update groff less py-pip
|
|
pip install awscli
|
|
FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
|
docker build --build-arg VERSION_BUCKET=bin-dev --build-arg FALCO_VERSION=${FALCO_VERSION} -t "public.ecr.aws/falcosecurity/falco-no-driver:master" docker/no-driver
|
|
docker tag public.ecr.aws/falcosecurity/falco-no-driver:master public.ecr.aws/falcosecurity/falco:master-slim
|
|
aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/falcosecurity
|
|
docker push "public.ecr.aws/falcosecurity/falco-no-driver:master"
|
|
docker push "public.ecr.aws/falcosecurity/falco:master-slim"
|
|
- run:
|
|
name: Build and publish falco (dev) to AWS
|
|
command: |
|
|
apk update
|
|
apk add --update groff less py-pip
|
|
pip install awscli
|
|
FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
|
docker build --build-arg VERSION_BUCKET=deb-dev --build-arg FALCO_VERSION=${FALCO_VERSION} -t "public.ecr.aws/falcosecurity/falco:master" docker/falco
|
|
aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/falcosecurity
|
|
docker push "public.ecr.aws/falcosecurity/falco:master"
|
|
- run:
|
|
name: Build and publish driver-loader (dev) to AWS
|
|
command: |
|
|
apk update
|
|
apk add --update groff less py-pip
|
|
pip install awscli
|
|
docker build --build-arg FALCO_IMAGE_TAG=master -t "public.ecr.aws/falcosecurity/falco-driver-loader:master" docker/driver-loader
|
|
aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/falcosecurity
|
|
docker push "public.ecr.aws/falcosecurity/falco-driver-loader:master"
|
|
# Publish the packages
|
|
"publish/packages":
|
|
docker:
|
|
- image: docker.io/centos:7
|
|
steps:
|
|
- attach_workspace:
|
|
at: /
|
|
- run:
|
|
name: Setup
|
|
command: |
|
|
yum install epel-release -y
|
|
yum update -y
|
|
yum install createrepo gpg python python-pip -y
|
|
pip install awscli==1.19.47
|
|
echo $GPG_KEY | base64 -d | gpg --import
|
|
- run:
|
|
name: Publish rpm
|
|
command: |
|
|
FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
|
/source/falco/scripts/publish-rpm -f /build/release/falco-${FALCO_VERSION}-x86_64.rpm -r rpm
|
|
- run:
|
|
name: Publish bin
|
|
command: |
|
|
FALCO_VERSION=$(cat /build-static/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
|
/source/falco/scripts/publish-bin -f /build-static/release/falco-${FALCO_VERSION}-x86_64.tar.gz -r bin -a x86_64
|
|
"publish/packages-deb":
|
|
docker:
|
|
- image: docker.io/debian:stable
|
|
steps:
|
|
- attach_workspace:
|
|
at: /
|
|
- run:
|
|
name: Setup
|
|
command: |
|
|
apt update -y
|
|
apt-get install apt-utils bzip2 gpg python python3-pip -y
|
|
pip install awscli
|
|
echo $GPG_KEY | base64 -d | gpg --import
|
|
- run:
|
|
name: Publish deb
|
|
command: |
|
|
FALCO_VERSION=$(cat /build/release/userspace/falco/config_falco.h | grep 'FALCO_VERSION ' | cut -d' ' -f3 | sed -e 's/^"//' -e 's/"$//')
|
|
/source/falco/scripts/publish-deb -f /build/release/falco-${FALCO_VERSION}-x86_64.deb -r deb
|
|
# Publish docker packages
|
|
"publish/docker":
|
|
docker:
|
|
- image: docker:stable
|
|
steps:
|
|
- attach_workspace:
|
|
at: /
|
|
- checkout
|
|
- setup_remote_docker
|
|
- run:
|
|
name: Build and publish no-driver
|
|
command: |
|
|
docker build --build-arg VERSION_BUCKET=bin --build-arg FALCO_VERSION=${CIRCLE_TAG} -t "falcosecurity/falco-no-driver:${CIRCLE_TAG}" docker/no-driver
|
|
docker tag "falcosecurity/falco-no-driver:${CIRCLE_TAG}" falcosecurity/falco-no-driver:latest
|
|
docker tag "falcosecurity/falco-no-driver:${CIRCLE_TAG}" "falcosecurity/falco:${CIRCLE_TAG}-slim"
|
|
docker tag "falcosecurity/falco-no-driver:${CIRCLE_TAG}" "falcosecurity/falco:latest-slim"
|
|
echo ${DOCKERHUB_SECRET} | docker login -u ${DOCKERHUB_USER} --password-stdin
|
|
docker push "falcosecurity/falco-no-driver:${CIRCLE_TAG}"
|
|
docker push "falcosecurity/falco-no-driver:latest"
|
|
docker push "falcosecurity/falco:${CIRCLE_TAG}-slim"
|
|
docker push "falcosecurity/falco:latest-slim"
|
|
- run:
|
|
name: Build and publish falco
|
|
command: |
|
|
docker build --build-arg VERSION_BUCKET=deb --build-arg FALCO_VERSION=${CIRCLE_TAG} -t "falcosecurity/falco:${CIRCLE_TAG}" docker/falco
|
|
docker tag "falcosecurity/falco:${CIRCLE_TAG}" falcosecurity/falco:latest
|
|
echo ${DOCKERHUB_SECRET} | docker login -u ${DOCKERHUB_USER} --password-stdin
|
|
docker push "falcosecurity/falco:${CIRCLE_TAG}"
|
|
docker push "falcosecurity/falco:latest"
|
|
- run:
|
|
name: Build and publish falco-driver-loader
|
|
command: |
|
|
docker build --build-arg FALCO_IMAGE_TAG=${CIRCLE_TAG} -t "falcosecurity/falco-driver-loader:${CIRCLE_TAG}" docker/driver-loader
|
|
docker tag "falcosecurity/falco-driver-loader:${CIRCLE_TAG}" falcosecurity/falco-driver-loader:latest
|
|
echo ${DOCKERHUB_SECRET} | docker login -u ${DOCKERHUB_USER} --password-stdin
|
|
docker push "falcosecurity/falco-driver-loader:${CIRCLE_TAG}"
|
|
docker push "falcosecurity/falco-driver-loader:latest"
|
|
# Publish container images to AWS ECR Public
|
|
"publish/container-images-aws":
|
|
docker:
|
|
- image: docker:stable
|
|
steps:
|
|
- attach_workspace:
|
|
at: /
|
|
- checkout
|
|
- setup_remote_docker
|
|
- run:
|
|
name: Build and publish no-driver to AWS
|
|
command: |
|
|
apk update
|
|
apk add --update groff less py-pip
|
|
pip install awscli
|
|
docker build --build-arg VERSION_BUCKET=bin --build-arg FALCO_VERSION=${CIRCLE_TAG} -t "public.ecr.aws/falcosecurity/falco-no-driver:${CIRCLE_TAG}" docker/no-driver
|
|
docker tag "public.ecr.aws/falcosecurity/falco-no-driver:${CIRCLE_TAG}" public.ecr.aws/falcosecurity/falco-no-driver:latest
|
|
docker tag "public.ecr.aws/falcosecurity/falco-no-driver:${CIRCLE_TAG}" "public.ecr.aws/falcosecurity/falco:${CIRCLE_TAG}-slim"
|
|
docker tag "public.ecr.aws/falcosecurity/falco-no-driver:${CIRCLE_TAG}" "public.ecr.aws/falcosecurity/falco:latest-slim"
|
|
aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/falcosecurity
|
|
docker push "public.ecr.aws/falcosecurity/falco:${CIRCLE_TAG}-slim"
|
|
docker push "public.ecr.aws/falcosecurity/falco:latest-slim"
|
|
docker push "public.ecr.aws/falcosecurity/falco-no-driver:${CIRCLE_TAG}"
|
|
docker push "public.ecr.aws/falcosecurity/falco-no-driver:latest"
|
|
- run:
|
|
name: Build and publish falco to AWS
|
|
command: |
|
|
apk update
|
|
apk add --update groff less py-pip
|
|
pip install awscli
|
|
docker build --build-arg VERSION_BUCKET=deb --build-arg FALCO_VERSION=${CIRCLE_TAG} -t "public.ecr.aws/falcosecurity/falco:${CIRCLE_TAG}" docker/falco
|
|
docker tag "public.ecr.aws/falcosecurity/falco:${CIRCLE_TAG}" public.ecr.aws/falcosecurity/falco:latest
|
|
aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/falcosecurity
|
|
docker push "public.ecr.aws/falcosecurity/falco:${CIRCLE_TAG}"
|
|
docker push "public.ecr.aws/falcosecurity/falco:latest"
|
|
- run:
|
|
name: Build and publish falco-driver-loader to AWS
|
|
command: |
|
|
apk update
|
|
apk add --update groff less py-pip
|
|
pip install awscli
|
|
docker build --build-arg FALCO_IMAGE_TAG=${CIRCLE_TAG} -t "public.ecr.aws/falcosecurity/falco-driver-loader:${CIRCLE_TAG}" docker/driver-loader
|
|
docker tag "public.ecr.aws/falcosecurity/falco-driver-loader:${CIRCLE_TAG}" public.ecr.aws/falcosecurity/falco-driver-loader:latest
|
|
aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/falcosecurity
|
|
docker push "public.ecr.aws/falcosecurity/falco-driver-loader:${CIRCLE_TAG}"
|
|
docker push "public.ecr.aws/falcosecurity/falco-driver-loader:latest"
|
|
workflows:
|
|
version: 2
|
|
build_and_test:
|
|
jobs:
|
|
- "build/musl"
|
|
- "build/minimal"
|
|
- "build/ubuntu-focal"
|
|
- "build/ubuntu-focal-debug"
|
|
- "build/ubuntu-bionic"
|
|
- "build/centos8"
|
|
- "build/centos7"
|
|
- "build/centos7-debug"
|
|
- "tests/integration":
|
|
requires:
|
|
- "build/centos7"
|
|
- "tests/integration-static":
|
|
requires:
|
|
- "build/musl"
|
|
- "tests/driver-loader/integration":
|
|
requires:
|
|
- "build/centos7"
|
|
- "rpm/sign":
|
|
context: falco
|
|
filters:
|
|
tags:
|
|
ignore: /.*/
|
|
branches:
|
|
only: master
|
|
requires:
|
|
- "tests/integration"
|
|
- "publish/packages-dev":
|
|
context:
|
|
- falco
|
|
- test-infra
|
|
filters:
|
|
tags:
|
|
ignore: /.*/
|
|
branches:
|
|
only: master
|
|
requires:
|
|
- "rpm/sign"
|
|
- "tests/integration-static"
|
|
- "publish/packages-deb-dev":
|
|
context:
|
|
- falco
|
|
- test-infra
|
|
filters:
|
|
tags:
|
|
ignore: /.*/
|
|
branches:
|
|
only: master
|
|
requires:
|
|
- "tests/integration"
|
|
- "publish/docker-dev":
|
|
context: falco
|
|
filters:
|
|
tags:
|
|
ignore: /.*/
|
|
branches:
|
|
only: master
|
|
requires:
|
|
- "publish/packages-dev"
|
|
- "publish/packages-deb-dev"
|
|
- "tests/driver-loader/integration"
|
|
- "publish/container-images-aws-dev":
|
|
context: test-infra # contains Falco AWS credentials
|
|
filters:
|
|
tags:
|
|
ignore: /.*/
|
|
branches:
|
|
only: master
|
|
requires:
|
|
- publish/docker-dev
|
|
# - "quality/static-analysis" # This is temporarly disabled: https://github.com/falcosecurity/falco/issues/1526
|
|
release:
|
|
jobs:
|
|
- "build/musl":
|
|
filters:
|
|
tags:
|
|
only: /.*/
|
|
branches:
|
|
ignore: /.*/
|
|
- "build/centos7":
|
|
filters:
|
|
tags:
|
|
only: /.*/
|
|
branches:
|
|
ignore: /.*/
|
|
- "rpm/sign":
|
|
context: falco
|
|
requires:
|
|
- "build/centos7"
|
|
filters:
|
|
tags:
|
|
only: /.*/
|
|
branches:
|
|
ignore: /.*/
|
|
- "publish/packages":
|
|
context:
|
|
- falco
|
|
- test-infra
|
|
requires:
|
|
- "build/musl"
|
|
- "rpm/sign"
|
|
filters:
|
|
tags:
|
|
only: /.*/
|
|
branches:
|
|
ignore: /.*/
|
|
- "publish/packages-deb":
|
|
context:
|
|
- falco
|
|
- test-infra
|
|
requires:
|
|
- "build/centos7"
|
|
filters:
|
|
tags:
|
|
only: /.*/
|
|
branches:
|
|
ignore: /.*/
|
|
- "publish/docker":
|
|
context:
|
|
- falco
|
|
- test-infra
|
|
requires:
|
|
- "publish/packages"
|
|
- "publish/packages-deb"
|
|
filters:
|
|
tags:
|
|
only: /.*/
|
|
branches:
|
|
ignore: /.*/
|
|
- "publish/container-images-aws":
|
|
context: test-infra # contains Falco AWS credentials
|
|
requires:
|
|
- "publish/docker"
|
|
filters:
|
|
tags:
|
|
only: /.*/
|
|
branches:
|
|
ignore: /.*/
|