develop sync with main

.dockerignore

@@ -0,0 +1,4 @@
+.idea
+.vscode
+x.json
+zz.yaml

.github/workflows/push.yaml

@@ -9,7 +9,6 @@ on:
       - CHANGELOG.md
       - LICENSE
   pull_request:
-    # Sequence of patterns matched against refs/heads
     branches:
       - main
     paths-ignore:
@@ -18,71 +17,109 @@ on:
       - LICENSE
 env:
   IMAGE_NAME: 'router'
+  ADAPTOR_IMAGE_NAME: 'router-adaptor'
 
 jobs:
-  build:
-    runs-on: ubuntu-20.04
-    strategy:
-      matrix:
-        platform:
-          - linux/amd64
-          - linux/386
-          - linux/arm/v6
-          - linux/arm/v7
-          - linux/arm64    
+  version:
+    name: Set version
+    runs-on: ubuntu-latest
     permissions:
-      actions: write
-      checks: write
-      contents: write
-      deployments: write
-      id-token: write
-      issues: write
-      discussions: write
-      packages: write
-      pages: write
-      pull-requests: write
-      repository-projects: write
-      security-events: write
-      statuses: write
-    name: Build and Publish
+      contents: read
+    outputs:
+      VERSION: ${{ steps.tags.outputs.VERSION }}
     steps:
-    - uses: actions/checkout@v3
-    - name: 'Get Previous tag'
-      id: previoustag
-      uses: "WyriHaximus/github-action-get-previous-tag@v1"
-      with:
-        fallback: 0.0.0
-    - name: Set image tag
-      shell: bash
-      id: tags
-      run: |
-        if [[ ${{ github.ref_name }} =~ ^v.* ]] ; then
-          VERSION=${{ github.ref_name }}
-          echo "VERSION=${VERSION:1}" >> "${GITHUB_OUTPUT}"
-        else
+      - uses: actions/checkout@v4
+      - name: Get Previous tag
+        id: previoustag
+        uses: "WyriHaximus/github-action-get-previous-tag@v1"
+        with:
+          fallback: 0.0.0
+      - name: Set image tag
+        shell: bash
+        id: tags
+        run: |
+          if [[ ${{ github.ref_name }} =~ ^v.* ]] ; then
+            VERSION=${{ github.ref_name }}
+            echo "VERSION=${VERSION:1}" >> "${GITHUB_OUTPUT}"
+          else
             VERSION=${{ steps.previoustag.outputs.tag }}
             echo "VERSION=${VERSION:1}-${{ github.run_number }}" >> "${GITHUB_OUTPUT}"
-        fi
+          fi
 
-    - name: Login to Github Container Registry
-
-      uses: docker/login-action@v2
-      with:
-        registry: "ghcr.io"
-        username: ${{ github.actor }}
-        password: ${{ secrets.PAT }}
+  build_amd64:
+    name: Build amd64
+    needs: version
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to Github Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: "ghcr.io"
+          username: ${{ github.actor }}
+          password: ${{ secrets.PAT }}
+      - name: Build and push amd64 image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile
+          platforms: linux/amd64
+          push: ${{ github.event_name == 'push' }}
+          tags: |
+            ghcr.io/datasance/${{ env.IMAGE_NAME }}:build-${{ github.run_id }}-amd64
 
-    - name: Build and Push to ghcr
-
-      uses: docker/build-push-action@v3
-      id: build_push_ghcr
-      with:
-        file: Dockerfile
-        platforms: ${{ matrix.platforms }}
-        push: true
-        outputs: type=image,name=target,annotation-index.org.opencontainers.image.description=Router
-        tags: |
-          ghcr.io/datasance/${{ env.IMAGE_NAME }}:${{ steps.tags.outputs.VERSION }}
-          ghcr.io/datasance/${{ env.IMAGE_NAME }}:latest
-          ghcr.io/datasance/${{ env.IMAGE_NAME }}:main
+  build_arm64:
+    name: Build arm64
+    needs: version
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to Github Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: "ghcr.io"
+          username: ${{ github.actor }}
+          password: ${{ secrets.PAT }}
+      - name: Build and push arm64 image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile
+          platforms: linux/arm64
+          push: ${{ github.event_name == 'push' }}
+          tags: |
+            ghcr.io/datasance/${{ env.IMAGE_NAME }}:build-${{ github.run_id }}-arm64
 
+  merge_manifest:
+    name: Merge multi-platform manifest
+    needs: [version, build_amd64, build_arm64]
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Login to Github Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: "ghcr.io"
+          username: ${{ github.actor }}
+          password: ${{ secrets.PAT }}
+      - name: Create and push multi-platform manifest
+        run: |
+          docker buildx imagetools create \
+            -t ghcr.io/datasance/${{ env.IMAGE_NAME }}:${{ needs.version.outputs.VERSION }} \
+            -t ghcr.io/datasance/${{ env.IMAGE_NAME }}:latest \
+            -t ghcr.io/datasance/${{ env.IMAGE_NAME }}:main \
+            ghcr.io/datasance/${{ env.IMAGE_NAME }}:build-${{ github.run_id }}-amd64 \
+            ghcr.io/datasance/${{ env.IMAGE_NAME }}:build-${{ github.run_id }}-arm64

.gitignore

@@ -1,2 +1,4 @@
 .idea
-.vscode
+.vscode
+x.json
+zz.yaml

Dockerfile

@@ -1,74 +1,94 @@
-# Build Apache Qpid Dispatch
-FROM ubuntu:latest AS qpid-builder
+FROM registry.access.redhat.com/ubi9/ubi-minimal:latest AS builder
+
+# upgrade first to avoid fixable vulnerabilities
+# do this in builder as well as in buildee, so builder does not have different pkg versions from buildee image
+RUN microdnf -y upgrade --refresh --best --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \
+ && microdnf clean all -y
+
+RUN microdnf -y --setopt=install_weak_deps=0 --setopt=tsflags=nodocs install \
+    rpm-build \
+    gcc gcc-c++ make cmake pkgconfig \
+    cyrus-sasl-devel openssl-devel libuuid-devel \
+    python3-devel python3-pip python3-wheel \
+    libnghttp2-devel \
+    wget tar patch findutils git \
+    libtool \
+ && microdnf clean all -y
+
+WORKDIR /build
+# Clone skupper-router so repo contents are in /build (not /build/skupper-router)
+RUN git clone --depth 1 --branch main https://github.com/skupperproject/skupper-router.git .
+ENV PROTON_VERSION=main
+ENV PROTON_SOURCE_URL=${PROTON_SOURCE_URL:-https://github.com/apache/qpid-proton/archive/${PROTON_VERSION}.tar.gz}
+ENV LWS_VERSION=v4.3.3
+ENV LIBUNWIND_VERSION=v1.8.1
+ENV LWS_SOURCE_URL=${LWS_SOURCE_URL:-https://github.com/warmcat/libwebsockets/archive/refs/tags/${LWS_VERSION}.tar.gz}
+ENV LIBUNWIND_SOURCE_URL=${LIBUNWIND_SOURCE_URL:-https://github.com/libunwind/libunwind/archive/refs/tags/${LIBUNWIND_VERSION}.tar.gz}
+ENV PKG_CONFIG_PATH=/usr/local/lib/pkgconfig
+
+ARG VERSION=0.0.0
+ENV VERSION=$VERSION
+ARG TARGETARCH
+ENV PLATFORM=$TARGETARCH
+RUN .github/scripts/compile.sh
+RUN mkdir -p /image && if [ "$PLATFORM" = "amd64" ]; then tar zxpf /qpid-proton-image.tar.gz -C /image && tar zxpf /skupper-router-image.tar.gz -C /image && tar zxpf /libwebsockets-image.tar.gz -C /image && tar zxpf /libunwind-image.tar.gz -C /image; fi
+RUN if [ "$PLATFORM" = "arm64" ]; then tar zxpf /qpid-proton-image.tar.gz -C /image && tar zxpf /skupper-router-image.tar.gz -C /image && tar zxpf /libwebsockets-image.tar.gz -C /image; fi
+RUN if [ "$PLATFORM" = "s390x" ]; then tar zxpf /qpid-proton-image.tar.gz -C /image && tar zxpf /skupper-router-image.tar.gz -C /image && tar zxpf /libwebsockets-image.tar.gz -C /image; fi
+RUN if [ "$PLATFORM" = "ppc64le" ]; then tar zxpf /qpid-proton-image.tar.gz -C /image && tar zxpf /skupper-router-image.tar.gz -C /image && tar zxpf /libwebsockets-image.tar.gz -C /image; fi
+
+RUN mkdir /image/licenses && cp ./LICENSE /image/licenses
+
+FROM registry.access.redhat.com/ubi9/ubi:latest AS packager
+
+RUN dnf -y --setopt=install_weak_deps=0 --nodocs \
+    --installroot /output install \
+    coreutils-single \
+    cyrus-sasl-lib cyrus-sasl-plain openssl \
+    python3 \
+    libnghttp2 \
+    hostname iputils \
+    shadow-utils \
+ && chroot /output useradd --uid 10000 runner \
+ && dnf -y --installroot /output remove shadow-utils \
+ && dnf clean all --installroot /output
+RUN [ -d /usr/share/buildinfo ] && cp -a /usr/share/buildinfo /output/usr/share/buildinfo ||:
+RUN [ -d /root/buildinfo ] && cp -a /root/buildinfo /output/root/buildinfo ||:
+
+FROM golang:1.23-alpine AS go-builder
+
+ARG TARGETOS
+ARG TARGETARCH
 
-ENV TZ=America/New_York
-ENV DEBIAN_FRONTEND=noninteractive
+RUN mkdir -p /go/src/github.com/datasance/router
+WORKDIR /go/src/github.com/datasance/router
+COPY . /go/src/github.com/datasance/router
+RUN go fmt ./...
+RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -trimpath  -ldflags="-s -w" -o bin/router .
 
-RUN apt-get update && \
-    apt-get install -y curl gcc g++ automake libwebsockets-dev libtool zlib1g-dev cmake libsasl2-dev libssl-dev python3 python3-dev libuv1-dev sasl2-bin swig maven git && \
-    apt-get -y clean
+FROM registry.access.redhat.com/ubi9/ubi-minimal:latest AS tz
+RUN microdnf install -y tzdata && microdnf reinstall -y tzdata
 
-RUN git clone -b 1.18.0 --single-branch https://gitbox.apache.org/repos/asf/qpid-dispatch.git
+FROM scratch
 
-WORKDIR /qpid-dispatch
-RUN git submodule add -b v3.0-stable https://github.com/warmcat/libwebsockets
-RUN git submodule add https://gitbox.apache.org/repos/asf/qpid-proton.git && cd qpid-proton/ && git checkout 0.39.0
+COPY --from=packager /output /
+COPY --from=packager /etc/yum.repos.d /etc/yum.repos.d
 
-# Transform deprecated errors into warning until we get this qpid thing sorted out
-RUN sed -i 's/-Werror/-Werror -Wno-error=deprecated-declarations/g' /qpid-dispatch/libwebsockets/CMakeLists.txt
-RUN sed -i 's/-Werror/-Werror -Wno-error=deprecated-declarations/g' /qpid-dispatch/qpid-proton/CMakeLists.txt
+USER 10000
 
-RUN mkdir libwebsockets/build && cd /qpid-dispatch/libwebsockets/build && cmake .. -DCMAKE_INSTALL_PREFIX=/usr && make install
+COPY --from=builder /image /
 
-WORKDIR /qpid-dispatch
-RUN mkdir qpid-proton/build && cd qpid-proton/build && cmake .. -DSYSINSTALL_BINDINGS=ON -DCMAKE_INSTALL_PREFIX=/usr -DSYSINSTALL_PYTHON=ON && make install
+WORKDIR /home/skrouterd/bin
+COPY ./scripts/* /home/skrouterd/bin/
 
-WORKDIR /qpid-dispatch
-RUN mkdir build && cd build && cmake .. -DCMAKE_INSTALL_PREFIX=/usr -DUSE_VALGRIND=NO && cmake --build . --target install
+ARG version=latest
+ENV VERSION=${version}
+ENV QDROUTERD_HOME=/home/skrouterd
 
-# Build ioFog Router utility
-FROM golang:1.21.5 AS go-builder
+COPY LICENSE /licenses/LICENSE
+COPY --from=go-builder /go/src/github.com/datasance/router/bin/router /home/skrouterd/bin/router
 
-RUN mkdir -p /go/src/github.com/datasance/router
-WORKDIR /go/src/github.com/datasance/router
-COPY . /go/src/github.com/datasance/router
-RUN go build -o bin/router
-
-# Build final image
-FROM ubuntu:latest
-
-RUN apt-get update && \
-    apt-get install -y python3 python3-dev iputils-ping libsasl2-modules nano && \
-    apt-get -y clean
-
-COPY --from=qpid-builder /usr/lib/lib* /usr/lib/
-COPY --from=qpid-builder /usr/lib/python3 /usr/lib/python3
-COPY --from=qpid-builder /usr/lib/python3.10 /usr/lib/python3.10
-COPY --from=qpid-builder /usr/lib/ssl /usr/lib/ssl
-COPY --from=qpid-builder /usr/lib/sasl2 /usr/lib/sasl2
-COPY --from=qpid-builder /usr/lib/openssh /usr/lib/openssh
-COPY --from=qpid-builder /usr/lib/*-linux-* /usr/lib/
-COPY --from=qpid-builder /usr/sbin/qdrouterd /usr/sbin/qdrouterd
-COPY --from=qpid-builder /usr/bin/qdmanage /usr/bin/qdmanage
-COPY --from=qpid-builder /usr/bin/qdstat /usr/bin/qdstat
-
-COPY --from=qpid-builder /usr/lib/qpid-dispatch /usr/lib/qpid-dispatch
-COPY --from=qpid-builder /usr/include/qpid /usr/include/qpid
-
-COPY --from=qpid-builder /usr/share/proton /usr/share/proton
-COPY --from=qpid-builder /usr/include/proton /usr/include/proton
-COPY --from=qpid-builder /usr/lib/pkgconfig/libqpid* /usr/lib/pkgconfig/
-COPY --from=qpid-builder /usr/lib/cmake/Proton /usr/lib/cmake/Proton
-COPY --from=qpid-builder /usr/share/proton /usr/share/proton
-
-# Silly hack to fix layer issue in Azure Devops :-/
-RUN true
-COPY --from=go-builder /go/src/github.com/datasance/router/bin/router /qpid-dispatch/router
-
-COPY scripts/launch.sh /qpid-dispatch/launch.sh
-
-ENV PYTHONPATH=/usr/lib/python3.10/site-packages
-LABEL org.opencontainers.image.description Router
-LABEL org.opencontainers.image.source=https://github.com/datasance/Router
-LABEL org.opencontainers.image.licenses=EPL2.0
-CMD ["/qpid-dispatch/router"]
+COPY --from=tz /usr/share/zoneinfo /usr/share/zoneinfo
+
+# Env: SKUPPER_PLATFORM=pot|kubernetes (default pot), QDROUTERD_CONF (default /tmp/skrouterd.json),
+# SSL_PROFILE_PATH (default /etc/skupper-router-certs). In K8s mode operator mounts config at QDROUTERD_CONF.
+CMD ["/home/skrouterd/bin/router"]

Dockerfile-dev

@@ -0,0 +1,23 @@
+FROM golang:1.23-alpine AS go-builder
+
+ARG TARGETOS
+ARG TARGETARCH
+
+RUN mkdir -p /go/src/github.com/datasance/router
+WORKDIR /go/src/github.com/datasance/router
+COPY . /go/src/github.com/datasance/router
+RUN go fmt ./...
+RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -trimpath  -ldflags="-s -w" -o bin/router .
+
+FROM registry.access.redhat.com/ubi9/ubi-minimal:latest AS tz
+RUN microdnf install -y tzdata && microdnf reinstall -y tzdata
+
+FROM quay.io/skupper/skupper-router:main
+COPY LICENSE /licenses/LICENSE
+COPY --from=go-builder /go/src/github.com/datasance/router/bin/router /home/skrouterd/bin/router
+COPY scripts/launch.sh /home/skrouterd/bin/launch.sh
+COPY --from=tz /usr/share/zoneinfo /usr/share/zoneinfo
+
+# Env: SKUPPER_PLATFORM=pot|kubernetes (default pot), QDROUTERD_CONF (default /tmp/skrouterd.json),
+# SSL_PROFILE_PATH (default /etc/skupper-router-certs). In K8s mode operator mounts config at QDROUTERD_CONF.
+CMD ["/home/skrouterd/bin/router"]

Dockerfile.adaptor

@@ -0,0 +1,3 @@
+FROM quay.io/skupper/kube-adaptor:2.0.1
+
+COPY LICENSE /licenses/LICENSE

README.md

@@ -1,3 +1,13 @@
 # iofog-router
 
-Builds an image of the Apache Qpid Dispatch Router designed for use with Eclipse ioFog
+Builds an image of the Apache Qpid Dispatch Router designed for use with Eclipse ioFog and Datasance Pot. The router can run in **Pot** mode (config from iofog agent) or **Kubernetes** mode (config from a volume-mounted file at `QDROUTERD_CONF`).
+
+## Environment variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `SKUPPER_PLATFORM` | `pot` | Mode: `pot` (config from iofog SDK) or `kubernetes` (config from file at `QDROUTERD_CONF`). |
+| `QDROUTERD_CONF` | `/tmp/skrouterd.json` | Path to the router JSON config file. In Kubernetes mode the operator must volume-mount the router ConfigMap at this path. |
+| `SSL_PROFILE_PATH` | `/etc/skupper-router-certs` | Directory under which SSL profile certs reside (e.g. `SSL_PROFILE_PATH/<profile-name>/ca.crt`, `tls.crt`, `tls.key`). Certs are mounted here in both K8s and Pot. |
+
+In Kubernetes mode the router does not use the Kubernetes API; the operator is responsible for mounting the router config at `QDROUTERD_CONF`. Config file changes are watched and applied to the running router via qdr (same as Pot mode).