Change Dockerfile base image

.github/workflows/container-scan-trivy.yml

@@ -25,7 +25,7 @@ jobs:
 
       - name: Build go binary
         run: |
-          go build -o serverservice .
+          go build -o fleetdb .
 
       - name: Build
         uses: docker/build-push-action@v4

.github/workflows/lint-test.yml

@@ -18,10 +18,10 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v4
         with:
-          go-version: '1.19'
+          go-version: '1.21.0'
 
       - name: Install cockroach binary
-        run: curl https://binaries.cockroachdb.com/cockroach-v21.1.7.linux-amd64.tgz | tar -xz && sudo cp -i cockroach-v21.1.7.linux-amd64/cockroach /usr/local/bin/
+        run: curl https://binaries.cockroachdb.com/cockroach-v23.1.11.linux-amd64.tgz | tar -xz && sudo cp -i cockroach-v23.1.11.linux-amd64/cockroach /usr/local/bin/
 
       - name: Start test database
         run: cockroach start-single-node --insecure --background
@@ -36,10 +36,10 @@ jobs:
           args: --timeout=5m
 
       - name: Run go tests and generate coverage report
-        run: SERVERSERVICE_CRDB_URI="host=localhost port=26257 user=root sslmode=disable dbname=serverservice_test" go test -race -coverprofile=coverage.txt -covermode=atomic -tags testtools -p 1 ./...
+        run: SERVERSERVICE_CRDB_URI="host=localhost port=26257 user=root sslmode=disable dbname=serverservice_test" go test -test.v -race -coverprofile=coverage.txt -covermode=atomic -tags testtools -p 1 ./...
 
       - name: Stop test database
-        run: cockroach quit --insecure --host=localhost:26257
+        run: cockroach node drain --insecure --host=localhost:26257
 
       - name: Upload coverage report
         uses: codecov/codecov-action@v3

.gitignore

@@ -11,4 +11,6 @@ cosign.key
 .vscode/
 .devcontainer/
 cockroach-data/
-coverage.txt
+coverage.txt
+*.swp
+*.swo

.goreleaser.yml

@@ -1,4 +1,4 @@
-project_name: serverservice
+project_name: fleetdb
 before:
   hooks:
     - go mod download
@@ -18,6 +18,7 @@ builds:
       - -X go.infratographer.com/x/versionx.commit={{.Commit}}
       - -X go.infratographer.com/x/versionx.date={{.Date}}
       - -X go.infratographer.com/x/versionx.builtBy=goreleaser
+    binary: fleetdb
 
 archives:
   -
@@ -51,7 +52,7 @@ changelog:
 dockers:
   -
     image_templates:
-      - "ghcr.io/metal-toolbox/hollow-{{.ProjectName}}:{{ .Tag }}"
+      - "ghcr.io/metal-toolbox/{{.ProjectName}}:{{ .Tag }}"
     dockerfile: Dockerfile
     build_flag_templates:
       - "--label=org.opencontainers.image.created={{.Date}}"

Dockerfile

@@ -1,8 +1,8 @@
-FROM gcr.io/distroless/static
+FROM gcr.io/distroless/static:debug
 
 # Copy the binary that goreleaser built
-COPY serverservice /serverservice
+COPY fleetdb /fleetdb
 
 # Run the web service on container startup.
-ENTRYPOINT ["/serverservice"]
+ENTRYPOINT ["/fleetdb"]
 CMD ["serve"]

Dockerfile.dev

@@ -16,7 +16,7 @@ RUN go mod tidy
 # Build the binary.
 # -mod=readonly ensures immutable go.mod and go.sum in container builds.
 RUN export LDFLAG_LOCATION="go.infratographer.com/x/versionx" && \
-    CGO_ENABLED=0 GOOS=linux go build -mod=readonly -v -o serverservice \
+    CGO_ENABLED=0 GOOS=linux go build -mod=readonly -v -o fleetdb \
 	-ldflags \
             "-X ${LDFLAG_LOCATION}.appName=serverservice \
              -X ${LDFLAG_LOCATION}.commit=$(git rev-parse --short HEAD) \
@@ -30,8 +30,8 @@ FROM alpine:3.18.3
 RUN apk add --no-cache ca-certificates
 
 # Copy the binary to the production image from the builder stage.
-COPY --from=builder /app/serverservice /serverservice
+COPY --from=builder /app/fleetdb /fleetdb
 
 # Run the web service on container startup.
-ENTRYPOINT ["/serverservice"]
+ENTRYPOINT ["/fleetdb"]
 CMD ["serve"]

Makefile

@@ -4,7 +4,7 @@ GOOS=linux
 DB_STRING=host=localhost port=26257 user=root sslmode=disable
 DEV_DB=${DB_STRING} dbname=serverservice
 TEST_DB=${DB_STRING} dbname=serverservice_test
-DOCKER_IMAGE  := "ghcr.io/metal-toolbox/hollow-serverservice"
+DOCKER_IMAGE  := "ghcr.io/metal-toolbox/fleetdb"
 
 ## run all tests
 test: | unit-test integration-test
@@ -17,7 +17,7 @@ integration-test: test-database
 ## run lint and unit tests
 unit-test: | lint
 	@echo Running unit tests...
-	@go test -cover -short -tags testtools ./...
+	@SERVERSERVICE_CRDB_URI="${TEST_DB}" go test -cover -short -tags testtools ./...
 
 ## check test coverage
 coverage: | test-database
@@ -72,9 +72,9 @@ test-database: | vendor
 
 ## Build linux bin
 build-linux:
-	GOOS=linux GOARCH=amd64 go build -o serverservice
+	GOOS=linux GOARCH=amd64 go build -o fleetdb
 
-## build docker image and tag as ghcr.io/metal-toolbox/hollow-serverservice:latest
+## build docker image and tag as ghcr.io/metal-toolbox/fleetdb:latest
 build-image: build-linux
 	docker build --rm=true -f Dockerfile -t ${DOCKER_IMAGE}:latest  . \
 							 --label org.label-schema.schema-version=1.0 \
@@ -83,9 +83,9 @@ build-image: build-linux
 
 ## build and push devel docker image to KIND image repo used by the sandbox - https://github.com/metal-toolbox/sandbox
 push-image-devel: build-image
-	docker tag ${DOCKER_IMAGE}:latest localhost:5001/serverservice:latest
-	docker push localhost:5001/serverservice:latest
-	kind load docker-image localhost:5001/serverservice:latest
+	docker tag ${DOCKER_IMAGE}:latest localhost:5001/fleetdb:latest
+	docker push localhost:5001/fleetdb:latest
+	kind load docker-image localhost:5001/fleetdb:latest
 
 
 # https://gist.github.com/prwhite/8168133

cmd/serve.go

@@ -7,6 +7,7 @@ import (
 	"github.com/jmoiron/sqlx"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
+	"github.com/volatiletech/sqlboiler/boil"
 	"go.hollow.sh/toolbox/events"
 	"go.hollow.sh/toolbox/ginjwt"
 	"go.infratographer.com/x/crdbx"
@@ -46,17 +47,8 @@ func init() {
 
 	// OIDC Flags
 	serveCmd.Flags().Bool("oidc", true, "use oidc auth")
-	viperx.MustBindFlag(viper.GetViper(), "oidc.enabled", serveCmd.Flags().Lookup("oidc"))
-	serveCmd.Flags().String("oidc-aud", "", "expected audience on OIDC JWT")
-	viperx.MustBindFlag(viper.GetViper(), "oidc.audience", serveCmd.Flags().Lookup("oidc-aud"))
-	serveCmd.Flags().String("oidc-issuer", "", "expected issuer of OIDC JWT")
-	viperx.MustBindFlag(viper.GetViper(), "oidc.issuer", serveCmd.Flags().Lookup("oidc-issuer"))
-	serveCmd.Flags().String("oidc-jwksuri", "", "URI for JWKS listing for JWTs")
-	viperx.MustBindFlag(viper.GetViper(), "oidc.jwksuri", serveCmd.Flags().Lookup("oidc-jwksuri"))
-	serveCmd.Flags().String("oidc-roles-claim", "claim", "field containing the permissions of an OIDC JWT")
-	viperx.MustBindFlag(viper.GetViper(), "oidc.claims.roles", serveCmd.Flags().Lookup("oidc-roles-claim"))
-	serveCmd.Flags().String("oidc-username-claim", "", "additional fields to output in logs from the JWT token, ex (email)")
-	viperx.MustBindFlag(viper.GetViper(), "oidc.claims.username", serveCmd.Flags().Lookup("oidc-username-claim"))
+	ginjwt.BindFlagFromViperInst(viper.GetViper(), "oidc.enabled", serveCmd.Flags().Lookup("oidc"))
+
 	// DB Flags
 	serveCmd.Flags().String("db-encryption-driver", "", "encryption driver uri; 32 byte base64 encoded string, (example: base64key://your-encoded-secret-key)")
 	viperx.MustBindFlag(viper.GetViper(), "db.encryption_driver", serveCmd.Flags().Lookup("db-encryption-driver"))
@@ -110,21 +102,22 @@ func serve(ctx context.Context) {
 		"address", viper.GetString("listen"),
 	)
 
+	logger.Infow("oidc enabled", "oidc", viper.GetString("oidc"))
+
+	var authCfgs []ginjwt.AuthConfig
+	if viper.GetViper().GetBool("oidc.enabled") {
+		authCfgs, err = ginjwt.GetAuthConfigsFromFlags(viper.GetViper())
+		if err != nil {
+			logger.Fatal(err)
+		}
+	}
+
 	hs := &httpsrv.Server{
-		Logger:        logger.Desugar(),
-		Listen:        viper.GetString("listen"),
-		Debug:         config.AppConfig.Logging.Debug,
-		DB:            db,
-		SecretsKeeper: keeper,
-		AuthConfig: ginjwt.AuthConfig{
-			Enabled:       viper.GetBool("oidc.enabled"),
-			Audience:      viper.GetString("oidc.audience"),
-			Issuer:        viper.GetString("oidc.issuer"),
-			JWKSURI:       viper.GetString("oidc.jwksuri"),
-			LogFields:     viper.GetStringSlice("oidc.log"),
-			RolesClaim:    viper.GetString("oidc.claims.roles"),
-			UsernameClaim: viper.GetString("oidc.claims.username"),
-		},
+		Logger:      logger.Desugar(),
+		Listen:      viper.GetString("listen"),
+		Debug:       config.AppConfig.Logging.Debug,
+		DB:          db,
+		AuthConfigs: authCfgs,
 	}
 
 	// init event stream - for now, only when nats.url is specified
@@ -186,6 +179,8 @@ func initDB() *sqlx.DB {
 		logger.Fatalw("failed to initialize database connection", "error", err)
 	}
 
+	boil.SetDB(sqldb)
+
 	db := sqlx.NewDb(sqldb, dbDriverName)
 
 	return db