cilium-1.17.yaml

package:
  name: cilium-1.17
  version: "1.17.2"
  epoch: 0
  description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane
  copyright:
    - license: Apache-2.0
  resources:
    cpu: 20
    memory: 64Gi
  dependencies:
    runtime:
      - bpftool
      # cilium does compilations at runtime on the node.
      - clang-17
      - cni-plugins-loopback
      # iptables packages are needed at build time because cilium-iptables
      # has a script that changes based on the presences of these packages
      # at build time.
      - ip6tables
      - iproute2
      - ipset
      - iptables
      - kmod
      - llvm17
      - merged-sbin
      - wolfi-baselayout
    provides:
      - cilium=${{package.full-version}}

environment:
  contents:
    packages:
      - bash
      - bazel-6
      - binutils
      - build-base
      - busybox
      - ca-certificates-bundle
      - clang-17
      - clang-17-dev
      - cmake
      - coreutils # for GNU install
      - git
      - go
      - grep
      - ip6tables
      - iptables # for cilium-iptables
      - isl-dev
      - libtool
      - llvm-libcxx-17
      - llvm-libcxx-17-dev
      - llvm-libcxxabi-17
      - llvm-lld-17
      - llvm17
      - llvm17-dev
      - mpc-dev
      - openjdk-11
      - patch
      - python3-dev
      - samurai
      - wolfi-baselayout

pipeline:
  - uses: git-checkout
    with:
      repository: https://github.com/cilium/cilium
      tag: v${{package.version}}
      expected-commit: fb3ab54ffe3f1b5059e87a9022fd6559b276b7ce

  - uses: go/bump
    with:
      deps: |-
        golang.org/x/crypto@v0.35.0
        golang.org/x/oauth2@v0.27.0
        golang.org/x/net@v0.36.0

  - uses: patch
    with:
      patches: loopback-location.patch

  - runs: |
      # Bazel errors out on toolchain stanza
      sed -i '/$toolchain /d' go.mod
      # Bazel errors out on go point release
      sed -i 's|^\(go 1\.[0-9]*\)\.[0-9]*|\1|' go.mod

  - runs: |
      # Remove groupadd from Makefile: it's not doing anything useful in
      # a package build anyway, and it's not available in busybox.
      find . -name Makefile -exec sed -i '/groupadd/d' {} \;

      DESTDIR=${{targets.destdir}} DISABLE_ENVOY_INSTALLATION=1 make build-container
      DESTDIR=${{targets.destdir}} DISABLE_ENVOY_INSTALLATION=1 make install-container

  - uses: strip

subpackages:
  - name: ${{package.name}}-container-init
    description: init scripts for cilium
    dependencies:
      provides:
        - cilium-container-init=${{package.full-version}}
      runtime:
        - merged-sbin
        - wolfi-baselayout
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}/usr/bin
          cp images/cilium/init-container.sh \
             plugins/cilium-cni/install-plugin.sh \
             plugins/cilium-cni/cni-uninstall.sh \
            ${{targets.subpkgdir}}/usr/bin

  - name: ${{package.name}}-container-init-compat
    description: init scripts for cilium
    dependencies:
      runtime:
        - ${{package.name}}-container-init
        - merged-sbin
        - wolfi-baselayout
      provides:
        - cilium-container-init-compat=${{package.full-version}}
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}
          ln -sf /usr/bin/init-container.sh ${{targets.subpkgdir}}/init-container.sh
          ln -sf /usr/bin/install-plugin.sh ${{targets.subpkgdir}}/install-plugin.sh
          ln -sf /usr/bin/cni-uninstall.sh ${{targets.subpkgdir}}/cni-uninstall.sh

  - name: ${{package.name}}-iptables
    description: iptables compatibility package for cilium
    dependencies:
      runtime:
        - iptables
        - merged-sbin
        - wolfi-baselayout
      provides:
        - cilium-iptables=${{package.full-version}}
    pipeline:
      - runs: |
          # This script generates a wrapper based on the version
          # of iptables provided by the build environment.
          ./images/runtime/iptables-wrapper-installer.sh
          mkdir -p ${{targets.subpkgdir}}/usr/bin
          mv /sbin/iptables-wrapper ${{targets.subpkgdir}}/usr/bin/iptables-wrapper
      - uses: strip

  - name: ${{package.name}}-operator-generic
    description: Generic operator for cilium
    dependencies:
      runtime:
        - gops
        - merged-sbin
        - wolfi-baselayout
      provides:
        - cilium-operator-generic=${{package.full-version}}
    pipeline:
      - runs: |
          cd /home/build/operator
          make cilium-operator-generic
          DESTDIR=${{targets.subpkgdir}} make install-generic
      - uses: strip

  - name: ${{package.name}}-operator-aws
    description: AWS operator for cilium
    dependencies:
      runtime:
        - gops
        - merged-sbin
        - wolfi-baselayout
      provides:
        - cilium-operator-aws=${{package.full-version}}
    pipeline:
      - runs: |
          cd /home/build/operator
          make cilium-operator-aws
          DESTDIR=${{targets.subpkgdir}} make install-aws
      - uses: strip

  - name: ${{package.name}}-hubble-relay
    description: Hubble relay
    dependencies:
      provides:
        - cilium-hubble-relay=${{package.full-version}}
      runtime:
        - merged-sbin
        - wolfi-baselayout
    pipeline:
      - runs: |
          cd /home/build/hubble-relay
          make hubble-relay
          DESTDIR=${{targets.subpkgdir}} make install
      - uses: strip

test:
  pipeline:
    - runs: |
        cilium version

update:
  enabled: true
  github:
    identifier: cilium/cilium
    strip-prefix: v
    tag-filter-prefix: v1.17.