runtime-enforcer/Tiltfile at main · rancher-sandbox/runtime-enforcer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
tilt_settings_file = "./tilt-settings.yaml"
settings = read_yaml(tilt_settings_file)

allow_k8s_contexts(settings.get("clusters"))

update_settings(
    k8s_upsert_timeout_secs=180,
)

# while it takes some time to install cert manager, it's okay to wait
# because we rely on its ca injector to setup our mutating webhook.
load('ext://cert_manager', 'deploy_cert_manager')

deploy_cert_manager(version="v1.18.2")

load("ext://helm_resource", "helm_resource", "helm_repo")
helm_repo("jetstack", "https://charts.jetstack.io")
helm_resource(
    "cert-manager-csi-driver",
    "jetstack/cert-manager-csi-driver",
    namespace="cert-manager",
)

# Create the namespace
# This is required since the helm() function doesn't support the create_namespace flag
load("ext://namespace", "namespace_create")
namespace_create("runtime-enforcer")

controller_image = settings.get("controller").get("image")
agent_image = settings.get("agent").get("image")
debugger_image = settings.get("debugger").get("image")

helm_options = [
        "controller.image.repository=" + controller_image,
        "agent.image.repository=" + agent_image,
        "controller.replicas=1",
        "controller.containerSecurityContext.runAsUser=null",
        "controller.podSecurityContext.runAsNonRoot=false",
        "agent.containerSecurityContext.runAsUser=null",
        "agent.podSecurityContext.runAsNonRoot=false",
        "debugger.enabled=true",
        "debugger.image.repository=" + debugger_image,
		# this is necessary to copy the debugger binary under `/debugger`
        "debugger.containerSecurityContext.runAsUser=null",
]

yaml = helm(
    "./charts/runtime-enforcer",
    name="runtime-enforcer",
    namespace="runtime-enforcer",
    set=helm_options
)

k8s_yaml(yaml)

# Hot reloading containers
local_resource(
    "controller_tilt",
    "make controller",
    deps=[
        "go.mod",
        "go.sum",
        "cmd/controller",
        "api",
        "internal/controller",
        "proto",
    ],
)

entrypoint = ["/controller"]
dockerfile = "./hack/Dockerfile.controller.tilt"

load("ext://restart_process", "docker_build_with_restart")
docker_build_with_restart(
    controller_image,
    ".",
    dockerfile=dockerfile,
    entrypoint=entrypoint,
    # `only` here is important, otherwise, the container will get updated
    # on _any_ file change.
    only=[
        "./bin/controller",
    ],
    live_update=[
        sync("./bin/controller", "/controller"),
    ],
)

exclusions = [
    "internal/bpf/bpf_**",
    "internal/controller/"
]

local_resource(
    "agent_tilt",
    "make agent",
    deps=[
        "go.mod",
        "go.sum",
        "cmd/agent",
        "api",
        "internal",
        "pkg",
        "bpf",
        "proto",
    ],
    ignore = exclusions,
)

entrypoint = ["/agent"]
# We use a specific Dockerfile since tilt can't run on a scratch container.
dockerfile = "./hack/Dockerfile.agent.tilt"

load("ext://restart_process", "docker_build_with_restart")
docker_build_with_restart(
    agent_image,
    ".",
    dockerfile=dockerfile,
    entrypoint=entrypoint,
    # `only` here is important, otherwise, the container will get updated
    # on _any_ file change.
    only=[
        "./bin/agent",
    ],
    live_update=[
        sync("./bin/agent", "/agent"),
    ],
)

local_resource(
    "runtime_debugger_tilt",
    "make debugger",
    deps=[
        "go.mod",
        "go.sum",
        "cmd/debugger",
        "api",
        "internal",
        "proto",
    ],
    ignore = exclusions,
)

entrypoint = ["/debugger"]
dockerfile = "./hack/Dockerfile.debugger.tilt"

load("ext://restart_process", "docker_build_with_restart")
docker_build_with_restart(
    debugger_image,
    ".",
    dockerfile=dockerfile,
    entrypoint=entrypoint,
    only=[
        "./bin/debugger",
    ],
    live_update=[
        sync("./bin/debugger", "/debugger"),
    ],
)