Backport upgrader changes to release-0.19 branch

Common.mk

@@ -103,7 +103,7 @@ SUPPORTED_K8S_VERSIONS=$(shell cat $(BASE_DIRECTORY)/release/SUPPORTED_RELEASE_B
 SKIPPED_K8S_VERSIONS?=
 BINARIES_ARE_RELEASE_BRANCHED?=true
 IS_RELEASE_BRANCH_BUILD=$(filter true,$(HAS_RELEASE_BRANCHES))
-UNRELEASE_BRANCH_BINARY_TARGETS=binaries attribution checksums
+UNRELEASE_BRANCH_BINARY_TARGETS=patch-repo binaries attribution checksums
 IS_UNRELEASE_BRANCH_TARGET=$(and $(filter false,$(BINARIES_ARE_RELEASE_BRANCHED)),$(filter $(UNRELEASE_BRANCH_BINARY_TARGETS) $(foreach target,$(UNRELEASE_BRANCH_BINARY_TARGETS),run-$(target)-in-docker run-in-docker/$(target)),$(MAKECMDGOALS)))
 TARGETS_ALLOWED_WITH_NO_RELEASE_BRANCH?=
 TARGETS_ALLOWED_WITH_NO_RELEASE_BRANCH+=build release clean clean-extra clean-go-cache help start-docker-builder stop-docker-builder create-ecr-repos all-attributions all-checksums all-attributions-checksums update-patch-numbers check-for-release-branch-skip run-buildkit-and-registry $(if $(filter false, $(HAS_LICENSES)),attribution,) $(if $(filter true, $(HAS_HELM_CHART)),,helm/push)
@@ -213,6 +213,7 @@ HELM_USE_UPSTREAM_IMAGE?=false
 HELM_DIRECTORY?=.
 HELM_DESTINATION_REPOSITORY?=$(HELM_CHART_NAME)
 HELM_IMAGE_LIST?=$(IMAGE_COMPONENT)
+HELM_IMAGE_TAG_LIST?=$(foreach _,$(HELM_IMAGE_LIST),$(IMAGE_TAG))
 HELM_GIT_CHECKOUT_TARGET?=$(HELM_SOURCE_REPOSITORY)/eks-anywhere-checkout-$(HELM_GIT_TAG)
 HELM_GIT_PATCH_TARGET?=$(HELM_SOURCE_REPOSITORY)/eks-anywhere-helm-patched
 PACKAGE_DEPENDENCIES?=
@@ -856,7 +857,7 @@ $(call FULL_CHART_TARGETS,copy) : %/helm/copy: checkout-repo checkout-helm-repo
 	@$(BUILD_LIB)/helm_copy.sh $(HELM_SOURCE_REPOSITORY) $(HELM_DESTINATION_REPOSITORY) $(HELM_DIRECTORY) $(OUTPUT_DIR)
 
 $(call FULL_CHART_TARGETS,require) : %/helm/require: %/helm/copy | $$(ENABLE_LOGGING)
-	@$(BUILD_LIB)/helm_require.sh $(HELM_SOURCE_IMAGE_REPO) $(HELM_DESTINATION_REPOSITORY) $(OUTPUT_DIR) $(IMAGE_TAG) $(HELM_TAG) $(PROJECT_ROOT) $(LATEST) $(HELM_USE_UPSTREAM_IMAGE) "$(PACKAGE_DEPENDENCIES)" "$(FORCE_JSON_SCHEMA_FILE)" $(HELM_IMAGE_LIST)
+	@$(BUILD_LIB)/helm_require.sh $(HELM_SOURCE_IMAGE_REPO) $(HELM_DESTINATION_REPOSITORY) $(OUTPUT_DIR) $(IMAGE_TAG) $(HELM_TAG) $(PROJECT_ROOT) $(LATEST) $(HELM_USE_UPSTREAM_IMAGE) "$(PACKAGE_DEPENDENCIES)" "$(FORCE_JSON_SCHEMA_FILE)" "$(HELM_IMAGE_LIST)" "$(HELM_IMAGE_TAG_LIST)"
 
 $(call FULL_CHART_TARGETS,replace) : %/helm/replace: %/helm/require | $$(ENABLE_LOGGING)
 	@$(BUILD_LIB)/helm_replace.sh $(HELM_DESTINATION_REPOSITORY) $(OUTPUT_DIR)

Makefile

@@ -207,7 +207,7 @@ generate-staging-buildspec: | ensure-locale
 	build/lib/generate_staging_buildspec.sh $(BASE_DIRECTORY) "emissary-ingress_emissary" "$(BASE_DIRECTORY)/projects/emissary-ingress/emissary/buildspecs/batch-build.yml" "$(BASE_DIRECTORY)/buildspec.yml" true "DO_NOT_EXCLUDE_FROM_BUILDSPEC"
 	build/lib/generate_staging_buildspec.sh $(BASE_DIRECTORY) "goharbor_harbor" "$(BASE_DIRECTORY)/projects/goharbor/harbor/buildspecs/batch-build.yml" "$(BASE_DIRECTORY)/buildspec.yml" true "DO_NOT_EXCLUDE_FROM_BUILDSPEC"
 	build/lib/generate_staging_buildspec.sh $(BASE_DIRECTORY) "aws_upgrader" "$(BASE_DIRECTORY)/projects/aws/upgrader/buildspecs/batch-build.yml" "$(BASE_DIRECTORY)/buildspec.yml" true "DO_NOT_EXCLUDE_FROM_BUILDSPEC"
-	build/lib/generate_staging_buildspec.sh $(BASE_DIRECTORY) "$(ALL_PROJECTS)" "$(BASE_DIRECTORY)/tools/version-tracker/buildspecs/upgrade.yml" "$(BASE_DIRECTORY)/buildspecs/upgrade-buildspec.yml" true EXCLUDE_FROM_UPGRADE_BUILDSPEC UPGRADE_BUILDSPECS false
+	build/lib/generate_staging_buildspec.sh $(BASE_DIRECTORY) "$(ALL_PROJECTS)" "$(BASE_DIRECTORY)/tools/version-tracker/buildspecs/upgrade.yml" "$(BASE_DIRECTORY)/buildspecs/upgrade-buildspec.yml" true EXCLUDE_FROM_UPGRADE_BUILDSPEC UPGRADE_BUILDSPECS false buildspecs/upgrade-eks-distro-buildspec.yml true
 
 .PHONY: generate
 generate: generate-project-list generate-staging-buildspec
@@ -254,3 +254,7 @@ ensure-locale:
 				exporting LANG=C.UTF-8 to generate files instead.; \
 		fi; \
 	fi
+
+.PHONY: get-default-release-branch
+get-default-release-branch:
+	@echo $(LATEST_EKSD_RELEASE)

build/lib/generate_staging_buildspec.sh

@@ -26,6 +26,7 @@ EXCLUDE_VAR="${6:-EXCLUDE_FROM_STAGING_BUILDSPEC}"
 BUILDSPECS_VAR="${7:-BUILDSPECS}"
 FAST_FAIL="${8:-true}"
 ADD_FINAL_STAGE="${9:-}"
+NO_DEPS_FOR_FINAL_STAGE="${10:-false}"
 
 SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
 source "${SCRIPT_ROOT}/common.sh"
@@ -164,6 +165,10 @@ for project in "${PROJECTS[@]}"; do
             BUILDSPEC_VARS_KEYS=""
         fi
 
+        if [[ "$BUILDSPECS_VAR" == "UPGRADE_BUILDSPECS" ]] && [[ "${IDENTIFIER}" = "kubernetes_sigs_image_builder" ]]; then
+            BUILDSPEC_VARS_KEYS=""
+        fi
+
         if [[ -n "$BUILDSPEC_VARS_KEYS" ]]; then
             KEYS=(${BUILDSPEC_VARS_KEYS// / })
 
@@ -241,8 +246,12 @@ done
 
 if [ -n "${ADD_FINAL_STAGE}" ]; then
     ARCH_TYPE="\"type\":\"ARM_CONTAINER\",\"compute-type\":\"BUILD_GENERAL1_SMALL\""
+    DEPEND_ON=",\"depend-on\":[${ALL_PROJECT_IDS%?}]"
+    if [ "$NO_DEPS_FOR_FINAL_STAGE" = "true" ]; then
+        DEPEND_ON=""
+    fi
     yq eval -i -P \
-        ".batch.build-graph += [{\"identifier\":\"final_stage\",\"buildspec\":\"$ADD_FINAL_STAGE\",\"env\":{$ARCH_TYPE},\"depend-on\":[${ALL_PROJECT_IDS%?}]}]" \
+        ".batch.build-graph += [{\"identifier\":\"final_stage\",\"buildspec\":\"$ADD_FINAL_STAGE\",\"env\":{$ARCH_TYPE}$DEPEND_ON}]" \
         $STAGING_BUILDSPEC_FILE 
 fi
 

build/lib/helm_replace.sh

@@ -43,4 +43,4 @@ if [ -d ${OUTPUT_DIR}/helm/${CHART_NAME}/crds ]; then
   do
     build::common::echo_and_run $SED -f ${SEDFILE} -i ${DEST_DIR}/${file}
   done
-fi
+fi

build/lib/helm_require.sh

@@ -28,7 +28,8 @@ LATEST="${7?Seventh argument is latest tag}"
 HELM_USE_UPSTREAM_IMAGE="${8?Eigth argument is bool determining whether to use cached upstream images}"
 PACKAGE_DEPENDENCIES="${9?Ninth argument is optional project dependencies}"
 FORCE_JSON_SCHEMA_FILE="${10?Tenth argument is optional schema file}"
-HELM_IMAGE_LIST="${@:11}"
+HELM_IMAGE_LIST="${11}"
+HELM_IMAGE_TAG_LIST="${12}"
 
 CHART_NAME=$(basename ${HELM_DESTINATION_REPOSITORY})
 DEST_DIR=${OUTPUT_DIR}/helm/${CHART_NAME}
@@ -78,7 +79,7 @@ function get_image_tag_not_latest() {
     # to find another tag associated with this image we have to use the aws cli
     # the following only works for ecr repos
     if [ "${JOB_TYPE:-}" = "presubmit" ] ||  [[ "${IMAGE_REGISTRY}" != *"ecr"* ]]; then
-      echo ${tag}      
+      echo ${tag}
     else
       if ! aws sts get-caller-identity &> /dev/null; then
         echo "The AWS cli is used to find the ECR registries and repos for the current AWS account please login!"
@@ -87,63 +88,70 @@ function get_image_tag_not_latest() {
 
       local service="ecr"
       if [[ "${IMAGE_REGISTRY}" = *"public.ecr"* ]]; then
-        service="--region us-east-1 ecr-public"      
+        service="--region us-east-1 ecr-public"
       fi
-      build::common::echo_and_run aws ${service} describe-images --repository-name ${image} --image-id imageDigest=${shasum} --query 'imageDetails[0].imageTags' --output yaml | grep -v ${LATEST} | head -1| sed -e 's/- //'      
+      build::common::echo_and_run aws ${service} describe-images --repository-name ${image} --image-id imageDigest=${shasum} --query 'imageDetails[0].imageTags' --output yaml | grep -v ${LATEST} | head -1| sed -e 's/- //'
     fi
 }
 
-for IMAGE in ${HELM_IMAGE_LIST:-}; do
-  # the image_list will include images built by the current project and potentially images built from
-  # other projects, ex: prometheus chart includes the node_exporter which is built seperately
-  # since each project is built independently and is tagged with the current HEAD commit hash
-  # images built via this current build may not be tagged exactly the same as images from other builds
-  # this code will first try to pull the image by the IMAGE_TAG and if that is not available
-  # it will fallback to the LATEST tag which follows the same pattern we use for artifacts on s3
-  # in the event that the LATEST tag is used, the ecr api will be used to get a different tag, which
-  # should be the tag in the format <version>-<commit-hash>, this tag will be used in the requires.yaml 
-  IMAGE_SHASUM=$(get_image_shasum ${IMAGE} ${IMAGE_TAG})
-
-  if [[ -z ${IMAGE_SHASUM} ]]; then
-    IMAGE_SHASUM=$(get_image_shasum ${IMAGE} ${LATEST})
-  fi
 
-  if [[ -z ${IMAGE_SHASUM} ]]; then
-    echo "Neither ${IMAGE}@${IMAGE_TAG} nor ${IMAGE}@${LATEST} exists!"
-    exit 1
-  fi 
-
-  echo "s,{{${IMAGE}}},${IMAGE_SHASUM},g" >>${SEDFILE}
-  if [ "${IMAGE_TAG}" = "${LATEST}" ]; then
-    # if finding an image from another project using the `latest` tag, find the image and a different tag associated with that image
-    USE_TAG=$(get_image_tag_not_latest ${IMAGE} ${IMAGE_SHASUM})
-    if [[ -z ${USE_TAG} ]]; then
-      echo "non-${LATEST} tag does not exist for ${IMAGE}@${IMAGE_SHASUM}!"
+if [ -n "$HELM_IMAGE_LIST" ]; then
+  HELM_IMAGE_ARR=($HELM_IMAGE_LIST)
+  HELM_IMAGE_TAG_ARR=($HELM_IMAGE_TAG_LIST)
+  for i in "${!HELM_IMAGE_ARR[@]}"; do
+    IMAGE="${HELM_IMAGE_ARR[$i]}"
+    TAG="${HELM_IMAGE_TAG_ARR[$i]}"
+    # the image_list will include images built by the current project and potentially images built from
+    # other projects, ex: prometheus chart includes the node_exporter which is built seperately
+    # since each project is built independently and is tagged with the current HEAD commit hash
+    # images built via this current build may not be tagged exactly the same as images from other builds
+    # this code will first try to pull the image by the IMAGE_TAG and if that is not available
+    # it will fallback to the LATEST tag which follows the same pattern we use for artifacts on s3
+    # in the event that the LATEST tag is used, the ecr api will be used to get a different tag, which
+    # should be the tag in the format <version>-<commit-hash>, this tag will be used in the requires.yaml
+    IMAGE_SHASUM=$(get_image_shasum ${IMAGE} ${TAG})
+
+    if [[ -z ${IMAGE_SHASUM} ]]; then
+      IMAGE_SHASUM=$(get_image_shasum ${IMAGE} ${LATEST})
+    fi
+
+    if [[ -z ${IMAGE_SHASUM} ]]; then
+      echo "Neither ${IMAGE}@${TAG} nor ${IMAGE}@${LATEST} exists!"
       exit 1
-    fi 
-  else
-    USE_TAG=$IMAGE_TAG
-  fi
-
-  # If HELM_USE_UPSTREAM_IMAGE is true, we are using images from upstream.
-  # Though we pull images directly from upstream for build tooling checks (i.e.
-  # get images shasums), we will use cached images in the helm charts. Cached
-  # images follow the convention of ${PROJECT_NAME}/${UPSTREAM_IMAGE_NAME}.
-  if [ "${HELM_USE_UPSTREAM_IMAGE}" == true ]; then
-    PROJECT_NAME=$(echo "$HELM_DESTINATION_REPOSITORY" | awk -F "/" '{print $1}')
-    IMAGE_REPO="${PROJECT_NAME}/${IMAGE}"
-  else
-    IMAGE_REPO="${IMAGE}"
-  fi
+    fi
 
-  cat >>${REQUIRES_FILE} <<!
-  - repository: ${IMAGE_REPO}
-    tag: ${USE_TAG}
-    digest: ${IMAGE_SHASUM}
+    echo "s,{{${IMAGE}}},${IMAGE_SHASUM},g" >>${SEDFILE}
+    if [ "${TAG}" = "${LATEST}" ]; then
+      # if finding an image from another project using the `latest` tag, find the image and a different tag associated with that image
+      USE_TAG=$(get_image_tag_not_latest ${IMAGE} ${IMAGE_SHASUM})
+      if [[ -z ${USE_TAG} ]]; then
+        echo "non-${LATEST} tag does not exist for ${IMAGE}@${IMAGE_SHASUM}!"
+        exit 1
+      fi
+    else
+      USE_TAG=$TAG
+    fi
+
+    # If HELM_USE_UPSTREAM_IMAGE is true, we are using images from upstream.
+    # Though we pull images directly from upstream for build tooling checks (i.e.
+    # get images shasums), we will use cached images in the helm charts. Cached
+    # images follow the convention of ${PROJECT_NAME}/${UPSTREAM_IMAGE_NAME}.
+    if [ "${HELM_USE_UPSTREAM_IMAGE}" == true ]; then
+      PROJECT_NAME=$(echo "$HELM_DESTINATION_REPOSITORY" | awk -F "/" '{print $1}')
+      IMAGE_REPO="${PROJECT_NAME}/${IMAGE}"
+    else
+      IMAGE_REPO="${IMAGE}"
+    fi
+
+    cat >>${REQUIRES_FILE} <<!
+    - repository: ${IMAGE_REPO}
+      tag: ${USE_TAG}
+      digest: ${IMAGE_SHASUM}
 !
-done
+  done
+fi
 
-if [ -n "${FORCE_JSON_SCHEMA_FILE}" ]; then 
+if [ -n "${FORCE_JSON_SCHEMA_FILE}" ]; then
   JSON_SCHEMA_FILE=${FORCE_JSON_SCHEMA_FILE}
 fi
 

buildspecs/upgrade-eks-distro-buildspec.yml

@@ -0,0 +1,14 @@
+version: 0.2
+
+env:
+  secrets-manager:
+    GITHUB_TOKEN: "github-eks-distro-pr-bot:github-token"
+
+phases:
+  pre_build:
+    commands:
+    - ./build/lib/setup.sh
+
+  build:
+    commands:
+    - make upgrade -C tools/version-tracker PROJECT=aws/eks-distro VERBOSITY=6

projects/aws/image-builder/builder/artifacts.go

@@ -6,9 +6,10 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
-	k8syaml "sigs.k8s.io/yaml"
 	"strings"
 
+	k8syaml "sigs.k8s.io/yaml"
+
 	releasev1 "github.com/aws/eks-anywhere/release/api/v1alpha1"
 	eksDreleasev1 "github.com/aws/eks-distro-build-tooling/release/api/v1alpha1"
 )

projects/aws/image-builder/builder/builder.go

@@ -80,7 +80,7 @@ func (b *BuildOptions) BuildImage() {
 		b.FilesConfig.FilesAnsibleConfig.CustomRoleNames = additionalFilesCustomRole
 		b.FilesConfig.FilesAnsibleConfig.AnsibleExtraVars = fmt.Sprintf("@%s", additionalFilesList)
 
-		log.Println("Marshaling files ansible config to JSON")
+		log.Println("Marshalling files ansible config to JSON")
 		filesAnsibleConfig, err := json.Marshal(b.FilesConfig.FilesAnsibleConfig)
 		if err != nil {
 			log.Fatalf("Error marshalling files ansible config data: %v", err)
@@ -93,7 +93,7 @@ func (b *BuildOptions) BuildImage() {
 			log.Fatalf("Error writing additional files config file to Packer config directory: %v", err)
 		}
 
-		log.Println("Marshaling additional files list to YAML")
+		log.Println("Marshalling additional files list to YAML")
 		if b.AMIConfig != nil {
 			for index, file := range b.FilesConfig.AdditionalFilesList {
 				for _, defaultFile := range DefaultAMIAdditionalFiles {

projects/aws/image-builder/builder/utils.go

@@ -168,7 +168,7 @@ func downloadFile(path, url string) error {
 	// Create the leading directories if it doesnt exists
 	dirs := filepath.Dir(path)
 	if _, err := os.Stat(dirs); os.IsNotExist(err) {
-		os.MkdirAll(dirs, 0755)
+		os.MkdirAll(dirs, 0o755)
 	}
 
 	// Create the file

projects/aws/image-builder/builder/utils_test.go

@@ -114,7 +114,7 @@ func TestDownloadFile(t *testing.T) {
 		t.Fatalf("Error getting current working dir: %v", err)
 	}
 	testDir := filepath.Join(cwd, "testdata")
-	os.MkdirAll(testDir, 0755)
+	os.MkdirAll(testDir, 0o755)
 	testcases := []struct {
 		name    string
 		path    string

projects/aws/image-builder/cmd/downloadartifacts.go

@@ -1,8 +1,9 @@
 package cmd
 
 import (
-	"github.com/spf13/cobra"
 	"log"
+
+	"github.com/spf13/cobra"
 )
 
 var downloadArtifactsCmd = &cobra.Command{

projects/aws/rolesanywhere-credential-helper/Makefile

@@ -12,6 +12,8 @@ HAS_S3_ARTIFACTS=true
 
 IMAGE_NAMES=
 
+EXCLUDE_FROM_UPGRADE_BUILDSPEC=true
+
 include $(BASE_DIRECTORY)/Common.mk
 
 

projects/cilium/cilium/Makefile

@@ -20,7 +20,6 @@ BUILD_TARGETS=upload-artifacts
 RELEASE_TARGETS=upload-artifacts
 
 EXCLUDE_FROM_CHECKSUMS_BUILDSPEC=true
-EXCLUDE_FROM_UPGRADE_BUILDSPEC=true
 
 include $(BASE_DIRECTORY)/Common.mk
 

projects/kubernetes/autoscaler/Makefile

@@ -15,7 +15,6 @@ FIX_LICENSES=$(REPO)/cluster-autoscaler/LICENSE
 
 HAS_RELEASE_BRANCHES=true
 EXCLUDE_FROM_STAGING_BUILDSPEC=true
-EXCLUDE_FROM_UPGRADE_BUILDSPEC=true
 SKIP_ON_RELEASE_BRANCH=true
 
 HAS_HELM_CHART=true

projects/kubernetes/cloud-provider-aws/Makefile

@@ -11,7 +11,6 @@ EXTRA_GO_LDFLAGS=-X k8s.io/component-base/version.gitVersion=$(shell cat ./$(REL
 
 HAS_S3_ARTIFACTS=true
 HAS_RELEASE_BRANCHES=true
-EXCLUDE_FROM_UPGRADE_BUILDSPEC=true
 BUILDSPEC_VARS_KEYS=RELEASE_BRANCH
 BUILDSPEC_VARS_VALUES=SUPPORTED_K8S_VERSIONS
 

projects/kubernetes/cloud-provider-vsphere/Makefile

@@ -15,7 +15,6 @@ SOURCE_PATTERNS=./cmd/vsphere-cloud-controller-manager
 IMAGE_COMPONENT=kubernetes/cloud-provider-vsphere/cpi/manager
 
 HAS_RELEASE_BRANCHES=true
-EXCLUDE_FROM_UPGRADE_BUILDSPEC=true
 
 BUILDSPEC_VARS_KEYS=RELEASE_BRANCH
 BUILDSPEC_VARS_VALUES=SUPPORTED_K8S_VERSIONS

projects/prometheus/prometheus/Makefile

@@ -2,6 +2,8 @@ BASE_DIRECTORY:=$(abspath ../../../)
 GIT_TAG=$(shell cat GIT_TAG)
 HELM_GIT_TAG=$(shell cat HELM_GIT_TAG)
 GOLANG_VERSION=$(shell cat GOLANG_VERSION)
+PROMETHEUS_NODE_EXPORTER_GIT_TAG=$(shell cat ../node_exporter/GIT_TAG)
+PROMETHEUS_NODE_EXPORTER_IMAGE_TAG=$(PROMETHEUS_NODE_EXPORTER_GIT_TAG)-$(GIT_HASH)
 REPO=prometheus
 REPO_OWNER=prometheus
 
@@ -34,6 +36,7 @@ HELM_SOURCE_OWNER=prometheus-community
 HELM_SOURCE_REPOSITORY=helm-charts
 HELM_DIRECTORY=charts/prometheus
 HELM_IMAGE_LIST=prometheus/prometheus prometheus/node-exporter
+HELM_IMAGE_TAG_LIST=$(IMAGE_TAG) $(PROMETHEUS_NODE_EXPORTER_IMAGE_TAG)
 
 HELM_CHART_NAMES=prometheus/charts/prometheus
 

tools/version-tracker/Makefile

@@ -1,6 +1,11 @@
+SHELL := bash
+.SHELLFLAGS:=-eux -o pipefail -c
+BASE_DIRECTORY:=$(shell git rev-parse --show-toplevel)
+
 BINARY_NAME?=version-tracker
 BINARY_PATH?=bin/$(BINARY_NAME)
-GO?=$(shell which go)
+GOLANG_VERSION=1.22
+GO ?= $(shell source $(BASE_DIRECTORY)/build/lib/common.sh && build::common::get_go_path $(GOLANG_VERSION))/go
 DRY_RUN?=false
 VERBOSITY?=0
 

tools/version-tracker/SKIPPED_PROJECTS

@@ -1 +0,0 @@
-cilium/cilium