Add image sync workflow

.github/workflows/sync-images.yaml

@@ -0,0 +1,60 @@
+name: sync images
+on: push
+
+jobs:
+  sync_images:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        component:
+          - skopeo-manifest-daskhub
+          - skopeo-manifest-jupyterhub
+          - skopeo-manifest-kubeflow
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@v3
+        # TODO: Revert to main branch before merging
+        with:
+          ref: skopeo
+
+      # Uncommment for SSH-able terminal session within runner to aid debugging
+      # - uses: actions/checkout@v2
+      # - name: Setup upterm session
+      #   uses: lhotari/action-upterm@v1
+
+      - name: Check component manifest for changes
+        uses: dorny/paths-filter@v2
+        id: changes
+        with:
+          filters: |
+            manifest:
+              - skopeo-manifests/${{ matrix.component }}.yml
+
+      # NOTE: Need skopeo > v1.09 to avoid this issue:
+      # https://github.com/containers/skopeo/issues/1874
+      # so use containerized version
+
+      - name: Sync component images
+        id: image-sync
+        if: ${{ steps.changes.outputs.manifest == 'true' }}
+        run: |-
+          docker run --entrypoint /usr/bin/env \
+            -v $GITHUB_WORKSPACE:/home/skopeo/azimuth-charts \
+            quay.io/skopeo/stable:v1.11 \
+            skopeo sync \
+              --src yaml \
+              --dest docker \
+              --dest-creds ${{ github.actor }}:${{ secrets.GITHUB_TOKEN }} \
+              --scoped \
+              --all \
+              /home/skopeo/azimuth-charts/skopeo-manifests/${{ matrix.component }}.yml \
+              ghcr.io/stackhpc/azimuth-charts \
+              |& tee sync-output.txt
+
+      - name: Check output for any sync errors
+        run: |
+          ERR_COUNT=$(grep "level=error" sync-output.txt | wc -l)
+          if [[ $ERR_COUNT -gt 0 ]]; then
+            echo "Found $ERR_COUNT logged error messages in output of image sync step"
+            exit 1
+          fi

skopeo-manifests/create-skopeo-manifest.py

@@ -0,0 +1,68 @@
+"""
+This script should be fed the `FILE_PATH` output of the following kubectl command which
+lists all container images currently in use on the target kubernetes cluster:
+
+kubectl get pods --all-namespaces -o jsonpath="{.items[*].spec.containers[*].image}" \ 
+| tr -s '[[:space:]]' '\n' | sort | uniq > FILE_PATH
+
+The script will then generate an output file named skopeo-manifest-{FILE_PATH}.yaml which 
+is formatted such that it can be fed into the sync-images.yml github workflow to copy any 
+required images into a dedicated container registry.
+
+NOTE: In order to capture the images used by the deployed platforms (e.g. the jupyter 
+notebook container) the relevant platform components should be deployed cluster before 
+running this script.
+"""
+
+import sys, yaml
+from pathlib import Path
+from functools import reduce
+
+if len(sys.argv) != 2:
+    print("Path to input file must be the sole command line arg to this script")
+    sys.exit(1)
+
+file_path = Path(sys.argv[1])
+# Kubernetes assumes docker registry by default:
+# https://kubernetes.io/docs/concepts/containers/images/#image-names
+default_registry = "docker.io"
+
+
+def split_image_url(url: str):
+    try:
+        parts = url.strip("\n").split("/")
+        registry = parts[0] if len(parts) > 1 else default_registry
+        # TODO: Check if skopeo copy a no-op when
+        #       source and destination are the same
+        if registry == "ghcr.io":
+            return {}
+        repo_plus_version = "/".join(parts[1:]) if len(parts) > 1 else parts[0]
+        repo, version = repo_plus_version.split(":")
+        if "@sha256" in repo:
+            repo = repo.replace("@sha256", "")
+            version = "sha256:" + version
+        return {registry: {"images": {repo: [version]}}}
+    except Exception as e:
+        raise Exception(f"Failed to parse url: {url}\nException was:", e)
+
+
+def dict_merge_recursive(d1, d2):
+    """update first dict with second recursively"""
+    try:
+        for k, v in d1.items():
+            if k in d2:
+                if isinstance(v, list):
+                    d2[k] += v
+                else:
+                    d2[k] = dict_merge_recursive(v, d2[k])
+        d1.update(d2)
+        return d1
+    except Exception as e:
+        raise Exception(f"Failed to merge dicts: {d1} & {d2}\nException was:", e)
+
+
+# Loop through lines in file and convert to a nested dict
+with open(file_path, "r") as file:
+    result_dict = reduce(dict_merge_recursive, map(split_image_url, file.readlines()))
+    with open(f"skopeo-manifest-{file_path.stem}.yml", "w") as out_file:
+        yaml.safe_dump(result_dict, out_file)

skopeo-manifests/skopeo-manifest-daskhub.yml

@@ -0,0 +1,34 @@
+docker.io:
+  images:
+    traefik:
+    - 2.6.3
+jupyterhub:
+  images:
+    configurable-http-proxy:
+    - 4.5.3
+    k8s-hub:
+    - 2.0.0
+    k8s-singleuser-sample:
+    - 2.0.0
+k8s.gcr.io:
+  images:
+    kube-scheduler:
+    - v1.23.10
+pangeo:
+  images:
+    base-notebook:
+    - 2022.10.31
+registry.k8s.io:
+  images:
+    coredns/coredns:
+    - v1.9.3
+    etcd:
+    - 3.5.6-0
+    kube-apiserver:
+    - v1.26.3
+    kube-controller-manager:
+    - v1.26.3
+    kube-proxy:
+    - v1.26.3
+    kube-scheduler:
+    - v1.26.3

skopeo-manifests/skopeo-manifest-jupyterhub.yml

@@ -0,0 +1,26 @@
+jupyterhub:
+  images:
+    configurable-http-proxy:
+    - 4.5.3
+    k8s-hub:
+    - 2.0.0
+    k8s-singleuser-sample:
+    - 2.0.0
+k8s.gcr.io:
+  images:
+    kube-scheduler:
+    - v1.23.10
+registry.k8s.io:
+  images:
+    coredns/coredns:
+    - v1.9.3
+    etcd:
+    - 3.5.6-0
+    kube-apiserver:
+    - v1.26.3
+    kube-controller-manager:
+    - v1.26.3
+    kube-proxy:
+    - v1.26.3
+    kube-scheduler:
+    - v1.26.3

skopeo-manifests/skopeo-manifest-kubeflow.yml

@@ -0,0 +1,137 @@
+docker.io:
+  images:
+    istio/pilot:
+    - 1.16.0
+    istio/proxyv2:
+    - 1.16.0
+    kubeflowkatib/katib-controller:
+    - v0.15.0
+    kubeflowkatib/katib-db-manager:
+    - v0.15.0
+    kubeflowkatib/katib-ui:
+    - v0.15.0
+    kubeflownotebookswg/centraldashboard:
+    - v1.7.0
+    kubeflownotebookswg/jupyter-web-app:
+    - v1.7.0
+    kubeflownotebookswg/kfam:
+    - v1.7.0
+    kubeflownotebookswg/notebook-controller:
+    - v1.7.0
+    kubeflownotebookswg/poddefaults-webhook:
+    - v1.7.0
+    kubeflownotebookswg/profile-controller:
+    - v1.7.0
+    kubeflownotebookswg/tensorboard-controller:
+    - v1.7.0
+    kubeflownotebookswg/tensorboards-web-app:
+    - v1.7.0
+    kubeflownotebookswg/volumes-web-app:
+    - v1.7.0
+    metacontrollerio/metacontroller:
+    - v2.0.4
+    mysql:
+    - 8.0.29
+    python:
+    - '3.7'
+gcr.io:
+  images:
+    arrikto/kubeflow/oidc-authservice:
+    - e236439
+    knative-releases/knative.dev/eventing/cmd/controller:
+    - sha256:33d78536e9b38dbb2ec2952207b48ff8e05acb48e7d28c2305bd0a0f7156198f
+    knative-releases/knative.dev/eventing/cmd/webhook:
+    - sha256:d217ab7e3452a87f8cbb3b45df65c98b18b8be39551e3e960cd49ea44bb415ba
+    knative-releases/knative.dev/net-istio/cmd/controller:
+    - sha256:2b484d982ef1a5d6ff93c46d3e45f51c2605c2e3ed766e20247d1727eb5ce918
+    knative-releases/knative.dev/net-istio/cmd/webhook:
+    - sha256:59b6a46d3b55a03507c76a3afe8a4ee5f1a38f1130fd3d65c9fe57fff583fa8d
+    knative-releases/knative.dev/serving/cmd/activator:
+    - sha256:c3bbf3a96920048869dcab8e133e00f59855670b8a0bbca3d72ced2f512eb5e1
+    knative-releases/knative.dev/serving/cmd/autoscaler:
+    - sha256:caae5e34b4cb311ed8551f2778cfca566a77a924a59b775bd516fa8b5e3c1d7f
+    knative-releases/knative.dev/serving/cmd/controller:
+    - sha256:38f9557f4d61ec79cc2cdbe76da8df6c6ae5f978a50a2847c22cc61aa240da95
+    knative-releases/knative.dev/serving/cmd/domain-mapping:
+    - sha256:763d648bf1edee2b4471b0e211dbc53ba2d28f92e4dae28ccd39af7185ef2c96
+    knative-releases/knative.dev/serving/cmd/domain-mapping-webhook:
+    - sha256:a4ba0076df2efaca2eed561339e21b3a4ca9d90167befd31de882bff69639470
+    knative-releases/knative.dev/serving/cmd/webhook:
+    - sha256:bc13765ba4895c0fa318a065392d05d0adc0e20415c739e0aacb3f56140bf9ae
+    kubebuilder/kube-rbac-proxy:
+    - v0.8.0
+    - v0.13.1
+    ml-pipeline/api-server:
+    - 2.0.0-alpha.7
+    ml-pipeline/cache-server:
+    - 2.0.0-alpha.7
+    ml-pipeline/frontend:
+    - 2.0.0-alpha.7
+    ml-pipeline/metadata-envoy:
+    - 2.0.0-alpha.7
+    ml-pipeline/metadata-writer:
+    - 2.0.0-alpha.7
+    ml-pipeline/minio:
+    - RELEASE.2019-08-14T20-37-41Z-license-compliance
+    ml-pipeline/mysql:
+    - 8.0.26
+    ml-pipeline/persistenceagent:
+    - 2.0.0-alpha.7
+    ml-pipeline/scheduledworkflow:
+    - 2.0.0-alpha.7
+    ml-pipeline/viewer-crd-controller:
+    - 2.0.0-alpha.7
+    ml-pipeline/visualization-server:
+    - 2.0.0-alpha.7
+    ml-pipeline/workflow-controller:
+    - v3.3.8-license-compliance
+    tfx-oss-public/ml_metadata_store_server:
+    - 1.5.0
+kserve:
+  images:
+    kserve-controller:
+    - v0.10.0
+    models-web-app:
+    - v0.10.0
+kubeflow:
+  images:
+    training-operator:
+    - v1-5a5f92d
+kubeflownotebookswg:
+  images:
+    jupyter-pytorch-cuda-full:
+    - v1.7.0
+    jupyter-pytorch-full:
+    - v1.7.0
+    jupyter-scipy:
+    - v1.7.0
+    jupyter-tensorflow-cuda-full:
+    - v1.7.0
+    jupyter-tensorflow-full:
+    - v1.7.0
+quay.io:
+  images:
+    jetstack/cert-manager-cainjector:
+    - v1.10.1
+    jetstack/cert-manager-controller:
+    - v1.10.1
+    jetstack/cert-manager-webhook:
+    - v1.10.1
+registry.k8s.io:
+  images:
+    coredns/coredns:
+    - v1.9.3
+    etcd:
+    - 3.5.6-0
+    kube-apiserver:
+    - v1.26.3
+    kube-controller-manager:
+    - v1.26.3
+    kube-proxy:
+    - v1.26.3
+    kube-scheduler:
+    - v1.26.3
+tensorflow:
+  images:
+    tensorflow:
+    - 2.5.1