emissary.yaml

package:
  name: emissary
  version: 3.9.1
  epoch: 13
  description: "open source Kubernetes-native API gateway for microservices built on the Envoy Proxy"
  copyright:
    - license: Apache-2.0
  dependencies:
    runtime:
      - datawire-envoy-privileged
      - git
      - py3-ambassador

vars:
  py-pkg: ambassador

data:
  - name: py-versions
    items:
      3.10: "310"
      3.11: "311"
      3.12: "312"
      3.13: "313"

environment:
  contents:
    packages:
      - iproute2
      - libcap-utils
      - py3-supported-pip
      - rust

pipeline:
  - uses: git-checkout
    with:
      repository: https://github.com/emissary-ingress/emissary
      tag: v${{package.version}}
      expected-commit: 6e2ca35c11d124da26df8dd029c33954960b15ae

  # Go binaries
  - uses: go/bump
    with:
      deps: |-
        google.golang.org/protobuf@v1.33.0
        k8s.io/kubernetes@v1.28.12
        k8s.io/apiserver@v0.28.12
        golang.org/x/oauth2@v0.27.0
        golang.org/x/net@v0.36.0

  - uses: go/build
    with:
      packages: ./cmd/busyambassador
      output: busyambassador

  - uses: go/build
    with:
      packages: ./cmd/capabilities_wrapper
      output: wrapper

  - name: wrapper-setcap
    # See https://github.com/emissary-ingress/emissary/blob/ac2dc64c6621cd8ec5617f3328544364bdd3fb01/build-aux/Dockerfile#L129-L137
    runs: |
      setcap cap_net_bind_service=p ${{targets.contextdir}}/usr/bin/wrapper

  - uses: go/build
    with:
      packages: ./cmd/kubestatus
      output: kubestatus

subpackages:
  - range: py-versions
    name: py${{range.key}}-${{vars.py-pkg}}
    description: python${{range.key}} version of emissary
    dependencies:
      provider-priority: ${{range.value}}
      provides:
        - py3-${{vars.py-pkg}}
    pipeline:
      - name: "Install dependencies"
        runs: |
          # Recommendation is to use the host pip instead of using venv.
          # Pip will complain about being run as root - this disables that warning.
          export PIP_ROOT_USER_ACTION=ignore

          # Install to target dir.
          # Ignore installed packages, since this looks at the builder host packages, when we're trying to install
          # the necessary packages into the target directory.
          python${{range.key}} -m pip install --no-cache-dir --ignore-installed --prefix=/usr --root=${{targets.contextdir}} -r python/requirements.txt
      - name: "Bump dependencies"
        runs: |
          # We're not 100% sure why this is necessary, but it seems to be needed to point pip -U at the right location for package upgrades.
          export PYTHONPATH=${{targets.contextdir}}/usr/lib/python${{range.key}}/site-packages

          # Bump the dependencies in the targetdir.
          python${{range.key}} -m pip install --no-cache-dir --prefix=/usr --root=${{targets.contextdir}} --upgrade \
            Jinja2==3.1.6 \
            certifi==2024.07.04 \
            gunicorn==22.0.0 \
            idna==3.7 \
            orjson==3.9.15 \
            requests==2.32.0 \
            urllib3==1.26.19 \
            Werkzeug==3.0.6

          # The command above won't actually install setuptools (we think because it's already installed on the host at a higher version).
          # We need --ignore-installed in order to force the installation of setuptools. Without it, pip only installs it for 1 version of python.
          # I don't know why this is necessary, but it is (if we figure out a better way to do this, we should).
          #
          # We can't use --ignore-installed for the list above, because it won't remove the old versions of the packages and the scanners will
          # complain about the old versions being present.
          # Running rm -rf existing setuptools first is a workaround for this.
          rm -rf ${{targets.contextdir}}/usr/lib/python${{range.key}}/site-packages/setuptools*
          python${{range.key}} -m pip install --no-cache-dir --prefix=/usr --root=${{targets.contextdir}} --ignore-installed --upgrade setuptools==70.0.0

          # We need to re-write the requirements file so that the next setup.py step will use the bumped versions.
          python${{range.key}} -m pip freeze > python/requirements.txt
      - runs: |
          # Generate version file - this static file is read by programs to provide version information in logs.
          # See https://github.com/emissary-ingress/emissary/blob/ac2dc64c6621cd8ec5617f3328544364bdd3fb01/python/ambassador/VERSION.py#L26
          make python/ambassador.version
          cp -p python/ambassador.version ${{targets.contextdir}}/usr/lib/python${{range.key}}/site-packages

          # Install Emissary Python package
          cd python
          python${{range.key}} setup.py install --prefix=/usr --root="${{targets.contextdir}}"

          # Install templates - this is not a python package, so it's not installed by the steps above.
          # This contains a set of HTML templates used by the Python code, but is read relative to the module.
          # See https://github.com/emissary-ingress/emissary/blob/ac2dc64c6621cd8ec5617f3328544364bdd3fb01/python/ambassador_diag/diagd.py#L603
          cp -a templates ${{targets.contextdir}}/usr/lib/python${{range.key}}/site-packages/templates
      - uses: strip
    test:
      pipeline:
        - uses: python/import
          with:
            python: python${{range.key}}
            imports: from ambassador import Version

  - name: ${{package.name}}-oci-entrypoint
    description: Entrypoint for ${{package.name}}
    pipeline:
      - runs: |
          mkdir -p ${{targets.contextdir}}/usr/bin/
          cp -p python/entrypoint.sh ${{targets.contextdir}}/usr/bin/entrypoint.sh
          chmod +x ${{targets.contextdir}}/usr/bin/entrypoint.sh
    test:
      pipeline:
        - runs: stat /usr/bin/entrypoint.sh

  - name: ${{package.name}}-apiext
    description: Emissary-ingress apiext webhook conversion server
    pipeline:
      - uses: go/build
        with:
          packages: ./cmd/apiext
          output: apiext

update:
  enabled: true
  github:
    identifier: emissary-ingress/emissary
    strip-prefix: v
    use-tag: true
  ignore-regex-patterns:
    - -rc.*
    - -dev.*
    - ^chart/

test:
  environment:
    contents:
      packages:
        - curl
        - emissary-oci-entrypoint
        - kwok
        - kwokctl
        - kubernetes
        - etcd
        - libcap-utils
  pipeline:
    - name: "Test entrypoint"
      uses: test/daemon-check-output
      with:
        # The default kwok pipeline doesn't run in bubblewrap, so we need to spawn it ourselves in the same pipeline step.
        setup: |
          kwokctl create cluster --runtime binary \
            --kube-apiserver-binary="/usr/bin/kube-apiserver" \
            --kube-controller-manager-binary="/usr/bin/kube-controller-manager" \
            --kube-scheduler-binary="/usr/bin/kube-scheduler" \
            --kwok-controller-binary="/usr/bin/kwok" \
            --etcd-binary="/usr/bin/etcd"

          kwokctl scale node --replicas 1
          kubectl wait --for=condition=Ready nodes --all
          kubectl cluster-info
        start: /usr/bin/entrypoint.sh
        timeout: "30"
        expected_output: "started command"
        # Can't use default error string set because logs will print error messages complaining it's not running in a pod.
        error_strings: |
          FAIL
          FATAL
        post: |
          sleep 10
          curl -i http://127.0.0.1:8004/ambassador/v0/check_alive
          curl -i http://127.0.0.1:8004/ambassador/v0/check_ready
    - name: Test file capabilities
      runs: |
        getcap /usr/bin/wrapper | cut -d ' ' -f2 | grep -q -E '^cap_net_bind_service=p$'