feat: Generate crds in Dockerfile

.gitea/workflows/build.yaml

@@ -9,7 +9,7 @@ on:
 
 jobs:
   build:
-    uses: infra/workflows/.gitea/workflows/docker.yaml@956337b9bd5e72a93d3a57513cd421e7554dd61d
+    uses: dreaded_x/workflows/.gitea/workflows/rust-kubernetes.yaml@ef78704b98c72e4a6b8340f9bff7b085a7bdd95c
     secrets: inherit
     with:
       webhook_url: ${{ secrets.WEBHOOK_URL }}

Dockerfile

@@ -1,7 +1,7 @@
 FROM rust:1.92 AS base
 ENV CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse
-RUN cargo install cargo-chef --locked --version 0.1.73 && \
-    cargo install cargo-auditable --locked --version 0.7.2
+RUN cargo install cargo-chef --locked --version 0.1.71 && \
+    cargo install cargo-auditable --locked --version 0.6.6
 WORKDIR /app
 
 FROM base AS planner
@@ -18,8 +18,8 @@ ENV RELEASE_VERSION=${RELEASE_VERSION}
 RUN cargo auditable build --release && /app/target/release/crdgen > /crds.yaml
 
 FROM scratch AS manifests
-COPY --from=builder /crds.yaml /
+COPY --from=base /crds.yaml /
 
-FROM gcr.io/distroless/cc-debian13:nonroot AS runtime
+FROM gcr.io/distroless/cc-debian12:nonroot AS runtime
 COPY --from=builder /app/target/release/lldap-controller /lldap-controller
 CMD ["/lldap-controller"]

docker-bake.hcl

@@ -2,27 +2,13 @@ variable "TAG_BASE" {}
 variable "RELEASE_VERSION" {}
 
 group "default" {
-  targets = ["lldap-controller", "manifests"]
+  targets = ["lldap-controller", "generate-crds"]
 }
 
 target "docker-metadata-action" {}
-target "cache" {
-  cache-from = [
-    {
-      type = "gha",
-    }
-  ]
-
-  cache-to = [
-    {
-      type = "gha",
-      mode = "max"
-    }
-  ]
-}
 
 target "lldap-controller" {
-  inherits = ["docker-metadata-action", "cache"]
+  inherits = ["docker-metadata-action"]
   context = "./"
   dockerfile = "Dockerfile"
   tags = [for tag in target.docker-metadata-action.tags : "${TAG_BASE}:${tag}"]
@@ -30,7 +16,6 @@ target "lldap-controller" {
 }
 
 target "manifests" {
-  inherits = ["cache"]
   context = "./"
   dockerfile = "Dockerfile"
   target = "manifests"

manifests/cluster-role-binding.yaml

@@ -2,11 +2,9 @@ kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: lldap-controller
-  namespace: lldap
 subjects:
   - kind: ServiceAccount
     name: lldap-controller
-    namespace: lldap
 roleRef:
   kind: ClusterRole
   name: lldap-controller

manifests/cluster-role.yaml

@@ -2,7 +2,6 @@ kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: lldap-controller
-  namespace: lldap
 rules:
   - apiGroups:
       - lldap.huizinga.dev

manifests/deployment.yaml

@@ -2,7 +2,6 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: lldap-controller
-  namespace: lldap
   labels:
     app: lldap-controller
     app.kubernetes.io/name: lldap-controller
@@ -19,17 +18,12 @@ spec:
         kubectl.kubernetes.io/default-container: lldap-controller
     spec:
       serviceAccountName: lldap-controller
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-        seccompProfile:
-          type: RuntimeDefault
+      securityContext: {}
       containers:
         - name: lldap-controller
-          image: '{{ index .images "lldap-controller" }}'
+          image: git.huizinga.dev/dreaded_x/lldap-controller@${DIGEST}
           imagePullPolicy: IfNotPresent
+          securityContext: {}
           resources:
             limits:
               cpu: 200m
@@ -49,16 +43,10 @@ spec:
             - name: LLDAP_USERNAME
               value: admin
             - name: LLDAP_PASSWORD_FILE
-              value: /secrets/credentials/admin-pass
+              value: /secrets/credentials/lldap-ldap-user-pass
             - name: LLDAP_BIND_DN
               value: uid={username},ou=people,dc=huizinga,dc=dev
-          securityContext:
-            allowPrivilegeEscalation: false
-            runAsNonRoot: true
-            capabilities:
-              drop:
-                - ALL
       volumes:
         - name: credentials
           secret:
-            secretName: credentials
+            secretName: lldap-credentials

manifests/kustomization.yaml

@@ -1,9 +1,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
+namespace: lldap
 resources:
-  - namespace.yaml
-  - crds.yaml
-  - service-account.yaml
-  - cluster-role.yaml
-  - cluster-role-binding.yaml
-  - deployment.yaml
+  - ./crds.yaml
+  - ./service-account.yaml
+  - ./cluster-role.yaml
+  - ./cluster-role-binding.yaml
+  - ./deployment.yaml

manifests/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: lldap

manifests/service-account.yaml

@@ -2,7 +2,6 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: lldap-controller
-  namespace: lldap
   labels:
     app: lldap-controller
     app.kubernetes.io/name: lldap-controller