diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index af6bc25d..58148422 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -11,10 +11,6 @@ on: docker_reference: description: 'wazuh-docker reference' required: true - products: - description: 'Comma-separated list of the image names to build and push' - default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent' - required: true filebeat_module_version: description: 'Filebeat module version' default: '0.4' @@ -23,11 +19,10 @@ on: description: 'Package revision' default: '1' required: true - push_images: - description: 'Push images' - type: boolean - default: true - required: true + reference: + description: 'Dev reference' + type: string + default: latest id: description: "ID used to identify the workflow uniquely." type: string @@ -48,11 +43,6 @@ on: description: 'wazuh-docker reference' required: false type: string - products: - description: 'Comma-separated list of the image names to build and push' - default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent' - required: true - type: string filebeat_module_version: description: 'Filebeat module version' default: '0.4' @@ -63,11 +53,10 @@ on: default: '1' required: true type: string - push_images: - description: 'Push images' - type: boolean - default: true - required: true + reference: + description: 'Dev reference' + type: string + default: latest id: description: "ID used to identify the workflow uniquely." type: string @@ -82,6 +71,16 @@ jobs: build-and-push: runs-on: ubuntu-22.04 + permissions: + id-token: write + contents: read + + env: + IMAGE_REGISTRY: ${{ inputs.dev && vars.IMAGE_REGISTRY_DEV || vars.IMAGE_REGISTRY_PROD }} + IMAGE_TAG: ${{ inputs.image_tag }} + FILEBEAT_MODULE_VERSION: ${{ inputs.filebeat_module_version }} + REVISION: ${{ inputs.revision }} + steps: - name: Print inputs run: | @@ -96,45 +95,88 @@ jobs: echo "* id: ${{ inputs.id }}" echo "* image_tag: ${{ inputs.image_tag }}" echo "* docker_reference: ${{ inputs.docker_reference }}" - echo "* products: ${{ inputs.products }}" echo "* filebeat_module_version: ${{ inputs.filebeat_module_version }}" echo "* revision: ${{ inputs.revision }}" - echo "* push_images: ${{ inputs.push_images }}" echo "* dev: ${{ inputs.dev }}" + echo "* dev reference: ${{ inputs.reference }}" echo "---------------------------------------------" - name: Checkout repository uses: actions/checkout@v4 with: ref: ${{ inputs.docker_reference }} + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Configure aws credentials + if: ${{ inputs.dev == true }} + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }} + aws-region: "${{ secrets.AWS_REGION }}" + + - name: Log in to Amazon ECR + if: ${{ inputs.dev == true }} + uses: aws-actions/amazon-ecr-login@v2 - name: Log in to Docker Hub + if: ${{ inputs.dev == false }} uses: docker/login-action@v3 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} + - name: Create packages-url.txt file + if : ${{ inputs.dev == true }} + run: | + cat << EOF > packages-url.txt + wazuh_manager_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1) + wazuh_manager_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1) + wazuh_manager_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1) + wazuh_manager_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1) + wazuh_indexer_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1) + wazuh_indexer_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1) + wazuh_indexer_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1) + wazuh_indexer_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1) + wazuh_dashboard_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1) + wazuh_dashboard_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1) + wazuh_dashboard_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1) + wazuh_dashboard_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1) + wazuh_agent_url_amd64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1) + wazuh_agent_url_arm64_deb: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1) + wazuh_agent_url_x86_64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1) + wazuh_agent_url_aarch64_rpm: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1) + wazuh_agent_url_i386_msi: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1) + wazuh_agent_url_intel64_pkg: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1) + wazuh_agent_url_arm64_pkg: $(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1) + EOF + working-directory: ./build-docker-images + - name: Build Wazuh images run: | - IMAGE_TAG=${{ inputs.image_tag }} - FILEBEAT_MODULE_VERSION=${{ inputs.filebeat_module_version }} - REVISION=${{ inputs.revision }} - - if [[ "$IMAGE_TAG" == *"-"* ]]; then - IFS='-' read -r -a tokens <<< "$IMAGE_TAG" - if [ -z "${tokens[1]}" ]; then - echo "Invalid image tag: $IMAGE_TAG" - exit 1 + if [ "${{ inputs.dev }}" = true ]; then + IMAGE_TAG="${{ inputs.image_tag }}-${{ inputs.reference }}" + ./build-images.sh -v ${{ inputs.image_tag }} -r $REVISION -d "dev" -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m -ref ${{ inputs.reference }} + else + if [[ "$IMAGE_TAG" == *"-"* ]]; then + IFS='-' read -r -a tokens <<< "$IMAGE_TAG" + if [ -z "${tokens[1]}" ]; then + echo "Invalid image tag: $IMAGE_TAG" + exit 1 + fi + DEV_STAGE=${tokens[1]} + WAZUH_VER=${tokens[0]} + ./build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m + else + ./build-images.sh -v $IMAGE_TAG -r $REVISION -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m fi - DEV_STAGE=${tokens[1]} - WAZUH_VER=${tokens[0]} - ./build-docker-images/build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -f $FILEBEAT_MODULE_VERSION - else - ./build-docker-images/build-images.sh -v $IMAGE_TAG -r $REVISION -f $FILEBEAT_MODULE_VERSION fi - # Save .env file (generated by build-images.sh) contents to $GITHUB_ENV - ENV_FILE_PATH=".env" + ENV_FILE_PATH="../.env" if [ -f $ENV_FILE_PATH ]; then while IFS= read -r line || [ -n "$line" ]; do @@ -144,16 +186,4 @@ jobs: echo "The environment file $ENV_FILE_PATH does not exist!" exit 1 fi - - - name: Tag and Push Wazuh images - if: ${{ inputs.push_images }} - run: | - IMAGE_TAG="${{ inputs.image_tag }}$( [ "${{ inputs.dev }}" == "true" ] && echo '-dev' || true )" - IMAGE_NAMES=${{ inputs.products }} - IFS=',' read -r -a images <<< "$IMAGE_NAMES" - for image in "${images[@]}"; do - echo "Tagging and pushing wazuh/$image:${WAZUH_VERSION} to wazuh/$image:$IMAGE_TAG" - docker tag wazuh/$image:${WAZUH_VERSION} wazuh/$image:$IMAGE_TAG - echo "Pushing wazuh/$image:$IMAGE_TAG ..." - docker push wazuh/$image:$IMAGE_TAG - done + working-directory: ./build-docker-images diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index fd8a102f..ceb4667d 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -15,6 +15,7 @@ IMAGE_VERSION=${WAZUH_IMAGE_VERSION} WAZUH_IMAGE_VERSION="5.0.0" WAZUH_TAG_REVISION="1" WAZUH_DEV_STAGE="" +WAZUH_TAG_REFERENCE="" FILEBEAT_MODULE_VERSION="0.4" # ----------------------------------------------------------------------------- @@ -38,35 +39,65 @@ build() { WAZUH_VERSION="$(echo $WAZUH_IMAGE_VERSION | sed -e 's/\.//g')" FILEBEAT_TEMPLATE_BRANCH="${WAZUH_IMAGE_VERSION}" + WAZUH_MINOR_VERSION="${WAZUH_IMAGE_VERSION%.*}" WAZUH_FILEBEAT_MODULE="wazuh-filebeat-${FILEBEAT_MODULE_VERSION}.tar.gz" WAZUH_UI_REVISION="${WAZUH_TAG_REVISION}" - if [ "${WAZUH_DEV_STAGE}" ];then - FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}-${WAZUH_DEV_STAGE,,}" - if ! curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then - echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}" - clean 1 - fi - else - if curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/v${FILEBEAT_TEMPLATE_BRANCH}"; then - FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}" - elif curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then - FILEBEAT_TEMPLATE_BRANCH="${FILEBEAT_TEMPLATE_BRANCH}" + if [ -z "${WAZUH_TAG_REFERENCE}" ]; then + if [ "${WAZUH_DEV_STAGE}" ];then + FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}-${WAZUH_DEV_STAGE,,}" + if ! curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then + echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}" + clean 1 + fi else - echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}" - clean 1 + if curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/v${FILEBEAT_TEMPLATE_BRANCH}"; then + FILEBEAT_TEMPLATE_BRANCH="v${FILEBEAT_TEMPLATE_BRANCH}" + elif curl --output /dev/null --silent --head --fail "https://github.com/wazuh/wazuh/tree/${FILEBEAT_TEMPLATE_BRANCH}"; then + FILEBEAT_TEMPLATE_BRANCH="${FILEBEAT_TEMPLATE_BRANCH}" + else + echo "The indicated branch does not exist in the wazuh/wazuh repository: ${FILEBEAT_TEMPLATE_BRANCH}" + clean 1 + fi fi fi + # Variables + FILE="packages_url.txt" - echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > .env - echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> .env - echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> .env - echo FILEBEAT_TEMPLATE_BRANCH=$FILEBEAT_TEMPLATE_BRANCH >> .env - echo WAZUH_FILEBEAT_MODULE=$WAZUH_FILEBEAT_MODULE >> .env - echo WAZUH_UI_REVISION=$WAZUH_UI_REVISION >> .env + if [[ -f "$FILE" ]]; then + echo "$FILE exists. Using existing file." + else + TAG="v${WAZUH_VERSION}" + REPO="wazuh/wazuh-docker" + GH_URL="https://api.github.com/repos/${REPO}/git/refs/tags/${TAG}" - docker compose -f build-docker-images/build-images.yml --env-file .env build --no-cache || clean 1 + if curl -fsSL "$GH_URL" >/dev/null 2>&1; then + curl -fsSL -o "$FILE" "https://packages.wazuh.com/${WAZUH_MINOR_VERSION}/packages_url.txt" + else + curl -fsSL -o "$FILE" "https://packages-dev.wazuh.com/${WAZUH_MINOR_VERSION}/packages_url.txt" + fi + fi + sed -Ei 's/^([^:]+):[[:space:]]+(https?:\/\/.*)$/\1=\2/' $FILE + sed 's/[-.]/_/g' $FILE > packages_env.txt + + echo WAZUH_VERSION=$WAZUH_IMAGE_VERSION > ../.env + echo WAZUH_IMAGE_VERSION=$WAZUH_IMAGE_VERSION >> ../.env + echo WAZUH_TAG_REVISION=$WAZUH_TAG_REVISION >> ../.env + echo FILEBEAT_TEMPLATE_BRANCH=$FILEBEAT_TEMPLATE_BRANCH >> ../.env + echo WAZUH_FILEBEAT_MODULE=$WAZUH_FILEBEAT_MODULE >> ../.env + echo WAZUH_UI_REVISION=$WAZUH_UI_REVISION >> ../.env + echo WAZUH_REGISTRY=$WAZUH_REGISTRY >> ../.env + set -a + source ../.env + source packages_env.txt + set +a + + if [ "${MULTIARCH}" ];then + docker buildx bake --file build-images.yml --push --set *.platform=linux/amd64,linux/arm64 --no-cache|| clean 1 + else + docker buildx bake --file build-images.yml --no-cache|| clean 1 + fi return 0 } @@ -79,7 +110,10 @@ help() { echo " -d, --dev [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default." echo " -f, --filebeat-module [Optional] Set Filebeat module version. By default ${FILEBEAT_MODULE_VERSION}." echo " -r, --revision [Optional] Package revision. By default ${WAZUH_TAG_REVISION}" + echo " -ref, --reference [Optional] Set the Wazuh reference to build development images. By default, the latest stable release." + echo " -rg, --registry [Optional] Set the Docker registry to push the images." echo " -v, --version [Optional] Set the Wazuh version should be builded. By default, ${WAZUH_IMAGE_VERSION}." + echo " -m, --multiarch [Optional] Enable multi-architecture builds." echo " -h, --help Show this help." echo exit $1 @@ -110,6 +144,10 @@ main() { help 1 fi ;; + "-m"|"--multiarch") + MULTIARCH="true" + shift + ;; "-r"|"--revision") if [ -n "${2}" ]; then WAZUH_TAG_REVISION="${2}" @@ -118,6 +156,22 @@ main() { help 1 fi ;; + "-ref"|"--reference") + if [ -n "${2}" ]; then + WAZUH_TAG_REFERENCE="${2}" + shift 2 + else + help 1 + fi + ;; + "-rg"|"--registry") + if [ -n "${2}" ]; then + WAZUH_REGISTRY="${2}" + shift 2 + else + help 1 + fi + ;; "-v"|"--version") if [ -n "$2" ]; then WAZUH_IMAGE_VERSION="$2" diff --git a/build-docker-images/build-images.yml b/build-docker-images/build-images.yml index 35d8d7a2..8f077440 100644 --- a/build-docker-images/build-images.yml +++ b/build-docker-images/build-images.yml @@ -8,7 +8,7 @@ services: WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} FILEBEAT_TEMPLATE_BRANCH: ${FILEBEAT_TEMPLATE_BRANCH} WAZUH_FILEBEAT_MODULE: ${WAZUH_FILEBEAT_MODULE} - image: wazuh/wazuh-manager:${WAZUH_IMAGE_VERSION} + image: ${WAZUH_REGISTRY}/wazuh/wazuh-manager:${IMAGE_TAG} hostname: wazuh.manager restart: always ports: @@ -38,7 +38,7 @@ services: args: WAZUH_VERSION: ${WAZUH_VERSION} WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} - image: wazuh/wazuh-agent:${WAZUH_IMAGE_VERSION} + image: ${WAZUH_REGISTRY}/wazuh/wazuh-agent:${IMAGE_TAG} hostname: wazuh.agent restart: always @@ -48,7 +48,7 @@ services: args: WAZUH_VERSION: ${WAZUH_VERSION} WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} - image: wazuh/wazuh-indexer:${WAZUH_IMAGE_VERSION} + image: ${WAZUH_REGISTRY}/wazuh/wazuh-indexer:${IMAGE_TAG} hostname: wazuh.indexer restart: always ports: @@ -70,7 +70,7 @@ services: WAZUH_VERSION: ${WAZUH_VERSION} WAZUH_TAG_REVISION: ${WAZUH_TAG_REVISION} WAZUH_UI_REVISION: ${WAZUH_UI_REVISION} - image: wazuh/wazuh-dashboard:${WAZUH_IMAGE_VERSION} + image: ${WAZUH_REGISTRY}/wazuh/wazuh-dashboard:${IMAGE_TAG} hostname: wazuh.dashboard restart: always ports: