move keepalived here from BMO repo

.github/workflows/build-images-action.yml

@@ -33,3 +33,15 @@ jobs:
       QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
       QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
       SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
+  build_keepalived:
+    name: Build keepalived container image
+    if: github.repository == 'metal3-io/utility-images'
+    uses: metal3-io/project-infra/.github/workflows/container-image-build.yml@main
+    with:
+      image-name: 'keepalived'
+      dockerfile-directory: keepalived
+      pushImage: true
+    secrets:
+      QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
+      QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
+      SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}

.github/workflows/keepalived-release.yaml

@@ -0,0 +1,138 @@
+# This code is borrowed from https://github.com/kubernetes-sigs/cluster-api/blob/main/.github/workflows/release.yaml
+name: Create Release
+
+on:
+  push:
+    branches:
+    - main
+    paths:
+    - 'keepalived/releasenotes/*.md'
+
+permissions: {}
+
+jobs:
+  push_release_tags:
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    outputs:
+      release_tag: ${{ steps.release-version.outputs.release_version }}
+    if: github.repository == 'metal3-io/utility-images'
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        fetch-depth: 0
+    - name: Get changed files
+      id: changed-files
+      uses: tj-actions/changed-files@bab30c2299617f6615ec02a68b9a40d10bd21366 # tag=v45.0.5
+    - name: Get release version
+      id: release-version
+      run: |
+        if [[ ${{ steps.changed-files.outputs.all_changed_files_count }} != 1 ]]; then
+          echo "1 release notes file should be changed to create a release tag, found ${{ steps.changed-files.outputs.all_changed_files_count }}"
+          exit 1
+        fi
+        for changed_file in ${{ steps.changed-files.outputs.all_changed_files }}; do
+          export RELEASE_VERSION=$(echo "${changed_file}" | grep -oP '(?<=/)[^/]+(?=\.md)')
+          echo "RELEASE_VERSION=${RELEASE_VERSION}" >> ${GITHUB_ENV}
+          echo "RELEASE_VERSION=${RELEASE_VERSION}" >> ${GITHUB_OUTPUT}
+          if [[ "${RELEASE_VERSION}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$ ]]; then
+            echo "Valid semver: ${RELEASE_VERSION}"
+          else
+            echo "Invalid semver: ${RELEASE_VERSION}"
+            exit 1
+          fi
+        done
+    - name: Determine the release branch to use
+      run: |
+        if [[ ${RELEASE_VERSION} =~ beta ]] || [[ ${RELEASE_VERSION} =~ alpha ]]; then
+          export RELEASE_BRANCH=main
+          echo "RELEASE_BRANCH=${RELEASE_BRANCH}" >> ${GITHUB_ENV}
+          echo "This is a beta or alpha release, will use release branch ${RELEASE_BRANCH}"
+        else
+          export RELEASE_BRANCH=release-$(echo ${RELEASE_VERSION} | sed -E 's/^v([0-9]+)\.([0-9]+)\..*$/\1.\2/')
+          echo "RELEASE_BRANCH=${RELEASE_BRANCH}" >> ${GITHUB_ENV}
+          echo "This is not a beta or alpha release, will use release branch ${RELEASE_BRANCH}"
+        fi
+    - name: Create or checkout release branch
+      run: |
+        if git show-ref --verify --quiet "refs/remotes/origin/${RELEASE_BRANCH}"; then
+          echo "Branch ${RELEASE_BRANCH} already exists"
+          git checkout "${RELEASE_BRANCH}"
+        else
+          git checkout -b "${RELEASE_BRANCH}"
+          git push origin "${RELEASE_BRANCH}"
+          echo "Created branch ${RELEASE_BRANCH}"
+        fi
+    - name: Validate tag does not already exist
+      run: |
+        if [[ -n "$(git tag -l "${RELEASE_VERSION}")" ]]; then
+          echo "Tag ${RELEASE_VERSION} already exists, exiting"
+          exit 1
+        fi
+    - name: Create Release Tag
+      run: |
+        git config user.name "${GITHUB_ACTOR}"
+        git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
+        git tag -a ${RELEASE_VERSION} -m ${RELEASE_VERSION}
+        git tag apis/${RELEASE_VERSION}
+        git tag test/${RELEASE_VERSION}
+        git tag pkg/hardwareutils/${RELEASE_VERSION}
+        git push origin ${RELEASE_VERSION}
+        git push origin apis/${RELEASE_VERSION}
+        git push origin test/${RELEASE_VERSION}
+        git push origin pkg/hardwareutils/${RELEASE_VERSION}
+        echo "Created tags ${RELEASE_VERSION}, apis/${RELEASE_VERSION}, pkg/hardwareutils/${RELEASE_VERSION}, and test/${RELEASE_VERSION}"
+  release:
+    name: create draft release
+    runs-on: ubuntu-latest
+    needs: push_release_tags
+    permissions:
+      contents: write
+    steps:
+    - name: Set env
+      run: echo "RELEASE_TAG=${RELEASE_TAG}" >> ${GITHUB_ENV}
+      env:
+        RELEASE_TAG: ${{needs.push_release_tags.outputs.release_tag}}
+    - name: checkout code
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        fetch-depth: 0
+        ref: ${{ env.RELEASE_TAG }}
+    - name: Calculate go version
+      run: echo "go_version=$(make go-version)" >> ${GITHUB_ENV}
+    - name: Set up Go
+      uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
+      with:
+        go-version: ${{ env.go_version }}
+    - name: generate release artifacts
+      run: |
+        make release
+    - name: get release notes
+      run: |
+        curl -L "https://raw.githubusercontent.com/${{ github.repository }}/main/releasenotes/${{ env.RELEASE_TAG }}.md" \
+        -o "${{ env.RELEASE_TAG }}.md"
+    - name: Release
+      uses: softprops/action-gh-release@7b4da11513bf3f43f9999e90eabced41ab8bb048 # v2.2.0
+      with:
+        draft: true
+        files: out/*
+        body_path: ${{ env.RELEASE_TAG }}.md
+        tag_name: ${{ env.RELEASE_TAG }}
+  build_keepalived:
+    permissions:
+      contents: read
+    needs: push_release_tags
+    name: Build keepalived container image
+    if: github.repository == 'metal3-io/utility-images'
+    uses: metal3-io/project-infra/.github/workflows/container-image-build.yml@main
+    with:
+      image-name: 'keepalived'
+      dockerfile-directory: keepalived
+      pushImage: true
+      ref: ${{ needs.push_release_tags.outputs.release_tag }}
+    secrets:
+      QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
+      QUAY_PASSWORD: ${{ secrets.QUAY_PASSWORD }}
+      SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}

README.md

@@ -74,3 +74,21 @@ FakeIPA simulate the IPA by:
   a queue of fake agents.
 - Faking the sync/async commands needed by ironic to inspect,
   clean and provision a node.
+
+## Keepalived
+
+Keepalived container used in Ironic deployments. Keepalived is used to
+provide fix IP address for Ironic in such a manner that even after pivoting
+operations the IP of Ironic stays persistent.
+
+[Keeplaived documentation](https://www.keepalived.org/manpage.html)
+
+Deployment configuration options:
+
+- `CUSTOM_CONF_DIR` - when specified, the config files will be moved to the
+  specified directory and the variable substitution will happen there
+- `PROVISIONING_IP` - the fix IP provided by keepalived
+- `PROVISIONING_INTERFACE` - The name of the interface that will be used
+  to "host" the fixed IP (keepalived is used in a pod that is attached to
+  host network, thus the interface names are the same as the interface names
+  on the host)

RELEASING.md

@@ -0,0 +1,157 @@
+# Releasing from from the utility-images repository
+
+This document details the steps to create a release for a project in the
+reporitory.
+
+## Before making a release
+
+Things you should check before making a release:
+
+- Always check if there are project specific release instructions in
+  the project specific directory.
+- Always check if there is a project specific verify-release.sh script in the
+  project's directory and if present run it and fix all issues highlighted
+  by the script prior to the release.
+
+## Permissions
+
+Creating a release requires repository `write` permissions for:
+
+- Tag pushing
+- Branch creation
+- GitHub Release publishing
+
+These permissions are implicit for the org admins and repository admins. Release
+team member gets his/her permissions via `metal3-release-team` membership. This
+GitHub team has the required permissions in each repository required to release
+BMO. Adding person to the team gives him/her the necessary rights in all
+relevant repositories in the organization. Individual persons should not be
+given permissions directly.
+
+## Process
+
+BMO uses [semantic versioning](https://semver.org).
+
+- Regular releases: `v0.x.y`
+- Beta releases: `v0.x.y-beta.z`
+- Release candidate releases: `v0.x.y-rc.z`
+
+### Repository setup
+
+Clone the repository: `git clone [email protected]:metal3-io/utility-images`
+
+or if using existing repository, make sure origin is set to the fork and
+upstream is set to `metal3-io`. Verify if your remote is set properly or not
+by using following command `git remote -v`.
+
+- Fetch the remote (`metal3-io`): `git fetch upstream`
+This makes sure that all the tags are accessible.
+
+### Creating Release Notes
+
+- Switch to the main branch: `git checkout main`
+
+- Create a new branch for the release notes**:
+  `git checkout -b release-notes-1.x.x origin/main`
+
+- Generate the release notes: `RELEASE_TAG=v1.x.x make release-notes`
+   - Replace `v1.x.x` with the new release tag you're creating.
+   - This command generates the release notes here
+     `releasenotes/<RELEASE_TAG>.md` .
+
+- Next step is to clean up the release note manually.
+   - If release is not a beta or release candidate, check for duplicates,
+     reverts, and incorrect classifications of PRs, and whatever release
+     creation tagged to be manually checked.
+   - For any superseded PRs (like same dependency uplifted multiple times, or
+     commit revertion) that provide no value to the release, move them to
+     Superseded section. This way the changes are acknowledged to be part of the
+     release, but not overwhelming the important changes contained by the
+     release.
+
+- Commit your changes, push the new branch and create a pull request:
+   - The commit and PR title should be 🚀 Release v1.x.y:
+      -`git commit -S -s -m ":rocket: Release v1.x.x"`
+      -`git push -u origin release-notes-1.x.x`
+   - Important! The commit should only contain the release notes file, nothing
+     else, otherwise automation will not work.
+
+- Ask maintainers and release team members to review your pull request.
+
+Once PR is merged following GitHub actions are triggered:
+
+- GitHub action `Create Release` runs following jobs:
+   - GitHub job `push_release_tags` will create and push the tags. This action
+     will also create release branch if its missing and release is `rc` or
+     minor.
+   - GitHub job `create draft release` creates draft release. Don't publish the
+     release until release tag is visible in. Running actions are visible on the
+     [Actions](https://github.com/metal3-io/utility-images/actions)
+     page, and draft release will be visible on top of the
+     [Releases](https://github.com/metal3-io/utility-images/releases).
+     If the release you're making is not a new major release, new minor release,
+     or a new patch release from the latest release branch, uncheck the box for
+     latest release. If it is a release candidate (RC) or a beta release,
+     tick pre-release box.
+   - GitHub jobs `build_keepalived` build release images with the
+     release tag, and push them to Quay. Make sure the release tags are visible in
+     Quay tags pages:
+      - [keepalived](https://quay.io/repository/metal3-io/keepalived?tab=tags)
+     If the new release tag is not available for any of the images, check if the
+     action has failed and retrigger as necessary.
+
+### Release artifacts
+
+We need to verify all release artifacts are correctly built or generated by the
+release workflow. For a release, we should have the following artifacts:
+
+There might be a project specific verify-release.sh in the project directory
+that might automates the following checks:
+
+Git tags pushed:
+
+- Primary release tag: `v0.x.y`
+
+Container images built and tagged at Quay registry:
+
+- [keepalived:v0.x.y](https://quay.io/repository/metal3-io/keepalived?tab=tags)
+
+Files included in the release page:
+
+- Source code
+
+### Make the release
+
+After everything is checked out, hit the `Publish` button your GitHub draft
+release!
+
+## Post-release actions for new release branches
+
+Some post-release actions are needed if new minor or major branch was created.
+
+### Branch protection rules
+
+Branch protection rules need to be applied to the new release branch. Copy the
+settings after the previous release branch, with the exception of
+`Required tests` selection. Required tests can only be selected after new
+keywords are implemented in Jenkins JJB, and project-infra, and have been run at
+least once in the PR targeting the branch in question. Branch protection rules
+require user to have `admin` permissions in the repository.
+
+### Update README.md and build badges
+
+Update `README.md` with release specific information, both on `main` and in the
+new `release-0.x` branch as necessary.
+
+[Prior art](https://github.com/metal3-io/baremetal-operator/pull/1517)
+
+In the `release-0.x` branch, update the build badges in the `README.md` to point
+to correct Jenkins jobs, so the build statuses of the release branch are
+visible.
+
+[Prior art](https://github.com/metal3-io/baremetal-operator/pull/1518)
+
+## Additional actions outside this repository
+
+For that, please continue following the instructions provided in
+[Metal3 release process](https://github.com/metal3-io/metal3-docs/blob/main/processes/releasing.md)

keepalived/Dockerfile

@@ -0,0 +1,16 @@
+# Support FROM override
+ARG BASE_IMAGE=ubuntu:22.04
+
+FROM $BASE_IMAGE
+ARG DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get -y update && \
+    apt-get -y install keepalived && \
+    apt-get -y clean
+
+COPY sample.keepalived.conf /etc/keepalived/keepalived.conf
+COPY manage-keepalived.sh configure-nonroot.sh /bin/
+
+RUN /bin/configure-nonroot.sh && rm /bin/configure-nonroot.sh
+
+CMD ["/bin/bash", "/bin/manage-keepalived.sh"]

keepalived/configure-nonroot.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/bash
+
+set -eux
+
+# create nonroot image matching the keepalived manifest
+NONROOT_USER="nonroot"
+NONROOT_GROUP="nonroot"
+NONROOT_UID=65532
+NONROOT_GID=65532
+
+# run as non-root, allow editing the keepalived.conf during startup
+groupadd -g "${NONROOT_GID}" "${NONROOT_GROUP}"
+useradd -u "${NONROOT_UID}" -g "${NONROOT_GID}" -m "${NONROOT_USER}"
+
+mkdir -p /run/keepalived
+chown -R root:"${NONROOT_GROUP}" /etc/keepalived /run/keepalived
+chmod 2775 /etc/keepalived /run/keepalived
+chmod 664 /etc/keepalived/keepalived.conf
+
+setcap "cap_net_raw,cap_net_broadcast,cap_net_admin=+eip" /usr/sbin/keepalived

keepalived/manage-keepalived.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/bash
+
+set -eux
+CUSTOM_CONF_DIR="${CUSTOM_CONF_DIR:-/conf}"
+CUSTOM_DATA_DIR="${CUSTOM_DATA_DIR:-/data}"
+KEEPALIVED_DEFAULT_CONF='/etc/keepalived/keepalived.conf'
+KEEPALIVED_CONF_DIR="${CUSTOM_CONF_DIR}/keepalived"
+KEEPALIVED_CONF="${KEEPALIVED_CONF_DIR}/keepalived.conf"
+KEEPALIVED_DATA_DIR="${CUSTOM_DATA_DIR}/keeplaived"
+mkdir -p "${KEEPALIVED_CONF_DIR}" "${KEEPALIVED_DATA_DIR}"
+cp "${KEEPALIVED_DEFAULT_CONF}" "${KEEPALIVED_CONF}"
+
+export assignedIP="${PROVISIONING_IP}/32"
+export interface="${PROVISIONING_INTERFACE}"
+
+sed -i "s~INTERFACE~${interface}~g" "${KEEPALIVED_CONF}"
+sed -i "s~CHANGEIP~${assignedIP}~g" "${KEEPALIVED_CONF}"
+
+exec /usr/sbin/keepalived --dont-fork --log-console \
+    --pid="${KEEPALIVED_DATA_DIR}/keepalived.pid" \
+    --vrrp_pid="${KEEPALIVED_DATA_DIR}/vrrp.pid" \
+    --use-file="${KEEPALIVED_CONF}"