unkin-agent
b5e68da270
Ship a distroless image so the plugin can run in-cluster in serve mode, letting developer laptops use the shared cache without S3 credentials. - Dockerfile: golang builder running `make build`, distroless static nonroot - `make docker` for a local smoke build - `.woodpecker/docker.yaml` pushes to docker-internal on tag - README: image name and the SSL_CERT_DIR mount the internal CA needs
79 lines
2.4 KiB
Markdown
79 lines
2.4 KiB
Markdown
# go-cache-plugin
|
|
|
|
Build repo for [`tailscale/go-cache-plugin`](https://github.com/tailscale/go-cache-plugin),
|
|
a `GOCACHEPROG` implementation that backs the Go build cache with S3. Upstream
|
|
publishes no releases, so this repo pins a commit via the `tool` directive in
|
|
`go.mod` and ships the static binary as a Gitea release.
|
|
|
|
No source of its own. To move to a newer upstream commit:
|
|
|
|
```sh
|
|
go get -tool github.com/tailscale/go-cache-plugin/cmd/go-cache-plugin@<commit>
|
|
make test
|
|
```
|
|
|
|
## Build
|
|
|
|
```sh
|
|
make build # dist/go-cache-plugin, CGO_ENABLED=0, stripped
|
|
make test # builds the binary, then drives a real `go build` through it
|
|
```
|
|
|
|
## Use
|
|
|
|
Point it at the estate's Ceph RGW, which needs both a custom endpoint and
|
|
path-style addressing:
|
|
|
|
```sh
|
|
export GOCACHEPROG="go-cache-plugin \
|
|
--cache-dir=$HOME/.cache/go-cache-plugin \
|
|
--bucket=go-build-cache \
|
|
--region=default \
|
|
--s3-endpoint-url=https://s3.ceph.unkin.net \
|
|
--s3-path-style"
|
|
go build ./...
|
|
```
|
|
|
|
Credentials come from the usual `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY`
|
|
environment. Every flag also has a `GOCACHE_*` environment equivalent — see
|
|
`go-cache-plugin help environment`. Add `--metrics` to print cache hit rates at
|
|
exit, and `--expiry` to age entries out.
|
|
|
|
For a shared cache daemon, run `go-cache-plugin serve --plugin <port>` once and
|
|
have each build use `go-cache-plugin connect <port>` as its `GOCACHEPROG`.
|
|
|
|
## Container image
|
|
|
|
`artifactapi.k8s.syd1.au.unkin.net/docker-internal/go-cache-plugin`, built and
|
|
pushed on tag. Distroless static, nonroot, no shell. `make docker` builds it
|
|
locally.
|
|
|
|
The image carries only the public CA bundle, so a `serve`-mode Deployment must
|
|
mount the internal CA and point Go at it:
|
|
|
|
```yaml
|
|
env:
|
|
- name: SSL_CERT_DIR
|
|
value: /etc/ssl/internal
|
|
```
|
|
|
|
`s3.ceph.unkin.net` is issued by `unkin.net Intermediate Authority`; without
|
|
that mount the S3 client fails with `x509: certificate signed by unknown
|
|
authority`.
|
|
|
|
## CI
|
|
|
|
Woodpecker steps fetch the released binary:
|
|
|
|
```yaml
|
|
commands:
|
|
- curl -fsSLo /usr/local/bin/go-cache-plugin https://git.unkin.net/unkin/go-cache-plugin/releases/download/v0.1.0/go-cache-plugin-linux-amd64
|
|
- chmod +x /usr/local/bin/go-cache-plugin
|
|
```
|
|
|
|
## Release
|
|
|
|
`make patch|minor|major` tags and pushes; the tag pipeline builds
|
|
`linux/amd64` and `linux/arm64`, attaches them with `sha256sums.txt`, and
|
|
pushes the container image tagged with the git tag and `latest`.
|