ci: resolve conflicts

.dockerignore

@@ -1,4 +1,6 @@
 *
 !artifacts/orbctl-Linux-x86_64
 !artifacts/gen-charts
-!dashboards/
+!artifacts/nodeagent
+!dashboards/
+!build/

.github/semantic.yml

@@ -0,0 +1,7 @@
+# Always validate the PR title AND all the commits
+titleAndCommits: false
+# Require at least one commit to be valid
+# this is only relevant when using commitsOnly: true or titleAndCommits: true,
+# which validate all commits by default
+anyCommit: true
+# Related docs https://github.com/zeke/semantic-pull-requests#configuration

.github/workflows/dev-release.yml

@@ -5,40 +5,44 @@ on:
       - master
 jobs:
   dev-release:
-    name: Dev-Release Orbos
+    name: Dev-Release ORBOS
     runs-on: ubuntu-18.04
     steps:
       - name: Source Checkout Dev
         id: source-checkout-dev
         uses: actions/checkout@v1
+      - uses: actions/setup-go@v2
         with:
-          fetch-depth: 1
+          go-version: '1.16.0'
       - name: Dev-Release
         id: dev-release
         shell: bash
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GO111MODULE: on
           CGO_ENABLED: 0
+          CR_PAT: ${{ secrets.CR_PAT }}
+          REGISTRY: ghcr.io
         run: |
-          export VERSION=${GITHUB_REF##*/}
+          export VERSION=${GITHUB_REF##*/}-dev
+          echo "::set-output name=version::$VERSION"
 
-          export IMAGE=docker.pkg.github.com/caos/orbos/orbos
+          export IMAGE=$REGISTRY/$GITHUB_REPOSITORY
           export TAG_VERSION=${IMAGE}:${VERSION}
 
           go mod download
           mkdir -p ./artifacts
-          go run cmd/gen-executables/*.go -version "$VERSION" -commit "${{ github.sha }}" -githubclientid "${{ secrets.GITHUBOAUTHCLIENTID }}" -githubclientsecret "${{ secrets.GITHUBOAUTHCLIENTSECRET }}" --orbctl ./artifacts
+          go run cmd/chore/gen-executables/*.go -version "$VERSION" -commit "${{ github.sha }}" -githubclientid "${{ secrets.GITHUBOAUTHCLIENTID }}" -githubclientsecret "${{ secrets.GITHUBOAUTHCLIENTSECRET }}" --orbctl ./artifacts
 
-          CGO_ENABLED=0 GOOS=linux go build -o ./artifacts/gen-charts  cmd/gen-charts/*.go
+          CGO_ENABLED=0 GOOS=linux go build -o ./artifacts/gen-charts  cmd/chore/gen-charts/*.go
 
-          echo "Publishing Orbos dev-version $VERSION"
-          docker login docker.pkg.github.com -u ci -p ${GITHUB_TOKEN}
-          docker build --tag ${TAG_VERSION} --file ./Dockerfile .
+          echo "Publishing ORBOS dev-version $VERSION"
+          docker login $REGISTRY -u $GITHUB_ACTOR -p $CR_PAT
+          docker build --tag ${TAG_VERSION} --file ./build/orbos/Dockerfile .
           docker push ${TAG_VERSION}
 
           echo "##[set-output name=relbranch;]$(echo ${VERSION})"
-          curl -X DELETE -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/repos/caos/orbos/releases/$(echo $(curl -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/repos/caos/orbos/releases/tags/$VERSION | jq .id))
+          curl -X DELETE -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/repos/caos/orbos/releases/$(echo $(curl -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/repos/caos/orbos/releases/tags/${VERSION} | jq .id))
       - name: Dev Release Create
         id: dev-release-create
         uses: actions/create-release@v1
@@ -102,4 +106,13 @@ jobs:
           upload_url: ${{ steps.dev-release-create.outputs.upload_url }}
           asset_path: ./artifacts/orbctl-Windows-x86_64.exe
           asset_name: orbctl Windows x86_64
-          asset_content_type: application/octet-stream
+          asset_content_type: application/octet-stream
+#      - name: Trigger E2E Test On StaticProvider
+#        if: steps.dev-release.outputs.relbranch != null
+#        run: go run ./cmd/chore/e2e/trigger/*.go --branch "${GITHUB_REF#refs/heads/}" --organization caos --repository ORBOS-Test-StaticProvider --access-token "${{ secrets.CR_PAT }}"
+#      - name: Trigger E2E Test On GCEProvider
+#        if: steps.dev-release.outputs.relbranch != null
+#        run: go run ./cmd/chore/e2e/trigger/*.go --branch "${GITHUB_REF#refs/heads/}" --organization caos --repository ORBOS-Test-GCEProvider --access-token "${{ secrets.CR_PAT }}"
+#      - name: Trigger E2E Test On CloudscaleProvider
+#        if: steps.dev-release.outputs.relbranch != null
+#        run: go run ./cmd/chore/e2e/trigger/*.go --branch "${GITHUB_REF#refs/heads/}" --organization caos --repository ORBOS-Test-CloudscaleProvider --access-token "${{ secrets.CR_PAT }}"

.github/workflows/release.yml

@@ -11,36 +11,60 @@ jobs:
       - name: Source Checkout
         id: source-checkout
         uses: actions/checkout@v1
+      - uses: actions/setup-go@v2
         with:
-          fetch-depth: 1
+          go-version: '1.16.0'
       - name: Release
         id: release
         shell: bash
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GO111MODULE: on
           CGO_ENABLED: 0
+          CR_PAT: ${{ secrets.CR_PAT }}
+          REGISTRY: ghcr.io
         run: |
           npm install [email protected]
           export BRANCH=${GITHUB_REF##*/}
           export VERSION=$BRANCH
           VERSION="v$(npx semantic-release --dry-run --plugins=@semantic-release/commit-analyzer --analize-commits | grep "The next release version is" | sed -ne 's/.*The\ next\ release\ version\ is\ \([0-9]\+\.[0-9]\+\.[0-9]\+\)$/\1/p')"
           [[ "$VERSION" == "v" ]] && echo "Exiting, as no new version needs to be released" && exit 0
+          echo "::set-output name=version::$VERSION"
 
-          export IMAGE=docker.pkg.github.com/caos/orbos/orbos
+          export IMAGE=$REGISTRY/$GITHUB_REPOSITORY
           export TAG_LATEST=${IMAGE}:latest
           export TAG_VERSION=${IMAGE}:${VERSION}
 
           go mod download
           mkdir -p ./artifacts
-          go run cmd/gen-executables/*.go -version "$VERSION" -commit "${{ github.sha }}" -githubclientid "${{ secrets.GITHUBOAUTHCLIENTID }}" -githubclientsecret "${{ secrets.GITHUBOAUTHCLIENTSECRET }}" --orbctl ./artifacts
+          go run cmd/chore/gen-executables/*.go -version "$VERSION" -commit "${{ github.sha }}" -githubclientid "${{ secrets.GITHUBOAUTHCLIENTID }}" -githubclientsecret "${{ secrets.GITHUBOAUTHCLIENTSECRET }}" --orbctl ./artifacts
 
-          CGO_ENABLED=0 GOOS=linux go build -o ./artifacts/gen-charts  cmd/gen-charts/*.go
+          CGO_ENABLED=0 GOOS=linux go build -o ./artifacts/gen-charts  cmd/chore/gen-charts/*.go
 
-          echo "Publishing Orbos version $VERSION"
-          docker login docker.pkg.github.com -u ci -p ${GITHUB_TOKEN}
-          docker build --tag ${TAG_LATEST} --tag ${TAG_VERSION} --file ./Dockerfile .
+          echo "Publishing ORBOS version $VERSION"
+          docker login $REGISTRY -u $GITHUB_ACTOR -p $CR_PAT
+          docker build --tag ${TAG_LATEST} --tag ${TAG_VERSION} --file ./build/orbos/Dockerfile .
 
           docker push ${TAG_VERSION}
           docker push ${TAG_LATEST}
-          npx semantic-release && exit 0
+
+          npx semantic-release && exit 0
+#      - name: Trigger E2E Test On StaticProvider
+#        if: steps.dev-release.outputs.relbranch != null
+#        run: go run ./cmd/chore/e2e/trigger/*.go --branch "${GITHUB_REF#refs/heads/}" --organization caos --repository ORBOS-Test-StaticProvider --access-token "${{ secrets.CR_PAT }}"
+#      - name: Trigger E2E Test On GCEProvider
+#        if: steps.dev-release.outputs.relbranch != null
+#        run: go run ./cmd/chore/e2e/trigger/*.go --branch "${GITHUB_REF#refs/heads/}" --organization caos --repository ORBOS-Test-GCEProvider --access-token "${{ secrets.CR_PAT }}"
+#      - name: Trigger E2E Test On CloudscaleProvider
+#        if: steps.dev-release.outputs.relbranch != null
+#        run: go run ./cmd/chore/e2e/trigger/*.go --branch "${GITHUB_REF#refs/heads/}" --organization caos --repository ORBOS-Test-CloudscaleProvider --access-token "${{ secrets.CR_PAT }}"
+      - name: Create Sentry release
+        uses: getsentry/action-release@v1
+        env:
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_ORG: caos
+          SENTRY_PROJECT: orbctl
+        with:
+          version: orbos-${{ steps.release.outputs.version }}
+          projects: "orbctl boom orbiter networking-operator node-agent"
+        if: steps.release.outputs.version != null

.gitignore

@@ -13,11 +13,16 @@ sandbox*
 *.dll
 *.so
 *.dylib
+orbctl
 
 # Test binary, built with `go test -c`
 *.test
 
 # Output of the go coverage tool, specifically when used with LiteIDE
 *.out
 
-/local
+# cypress results and videos
+cypress/results
+cypress/videos
+
+/local

.releaserc.js

@@ -1,15 +1,16 @@
 module.exports = {
-    plugins: [ 
+    plugins: [
         "@semantic-release/commit-analyzer",
         "@semantic-release/release-notes-generator",
         ["@semantic-release/github", {
             "assets": [
-              {"path": "./artifacts/orbctl-Darwin-x86_64", "label": "Darwin x86_64"},
-              {"path": "./artifacts/orbctl-FreeBSD-x86_64", "label": "FreeBSD x86_64"},
-              {"path": "./artifacts/orbctl-Linux-x86_64", "label": "Linux x86_64"},
-              {"path": "./artifacts/orbctl-OpenBSD-x86_64", "label": "OpenBSD x86_64"},
-              {"path": "./artifacts/orbctl-Windows-x86_64.exe", "label": "Windows x86_64"}
+                {"path": "./artifacts/orbctl-Darwin-x86_64", "label": "Darwin x86_64"},
+                {"path": "./artifacts/orbctl-Darwin-ARM64", "label": "Darwin ARM64"},
+                {"path": "./artifacts/orbctl-FreeBSD-x86_64", "label": "FreeBSD x86_64"},
+                {"path": "./artifacts/orbctl-Linux-x86_64", "label": "Linux x86_64"},
+                {"path": "./artifacts/orbctl-OpenBSD-x86_64", "label": "OpenBSD x86_64"},
+                {"path": "./artifacts/orbctl-Windows-x86_64.exe", "label": "Windows x86_64"},
             ]
         }]
     ]
-  };
+};

README.md

@@ -9,8 +9,6 @@
 [![Go Report Card](https://goreportcard.com/badge/github.com/caos/orbos)](https://goreportcard.com/report/github.com/caos/orbos)
 [![codecov](https://codecov.io/gh/caos/orbos/branch/master/graph/badge.svg)](https://codecov.io/gh/caos/orbos)
 
-> This project is in alpha state. The API will continue breaking until version 1.0.0 is released
-
 ## [ORBOS explained](docs/explained.md)
 
 ### [ORBITER](docs/orbiter/orbiter.md)
@@ -34,7 +32,8 @@ sudo chmod +x /usr/local/bin/orbctl
 sudo chown $(id -u):$(id -g) /usr/local/bin/orbctl
 
 # Create an orb file at ${HOME}/.orb/config
-orbctl configure --repourl [email protected]:me/my-orb.git --masterkey "$(openssl rand -base64 21)"
+MY_GIT_REPO="[email protected]:me/my-orb.git"
+orbctl --gitops configure --repourl ${MY_GIT_REPO} --masterkey "$(openssl rand -base64 21)"
 ```
 
 ### Configure a billable Google Cloud Platform project of your choice
@@ -59,28 +58,31 @@ gcloud projects add-iam-policy-binding ${MY_GCE_PROJECT} \
 gcloud projects add-iam-policy-binding ${MY_GCE_PROJECT} \
     --member=serviceAccount:${ORBOS_SERVICE_ACCOUNT} \
     --role=roles/serviceusage.serviceUsageAdmin
+gcloud projects add-iam-policy-binding ${MY_GCE_PROJECT} \
+    --member=serviceAccount:${ORBOS_SERVICE_ACCOUNT} \
+    --role=roles/iam.serviceAccountUser
 
 
 # Create a JSON key for the service account
 gcloud iam service-accounts keys create /tmp/key.json \
   --iam-account ${ORBOS_SERVICE_ACCOUNT}
 
 # Encrypt and write the created JSON key to the orbiter.yml
-orbctl writesecret orbiter.gce.jsonkey --file /tmp/key.json
+orbctl --gitops writesecret orbiter.gce.jsonkey --file /tmp/key.json
 rm -f /tmp/key.json
 ```
 
 ### Bootstrap your Kubernetes cluster on GCE
 
 ```bash
-orbctl takeoff
+orbctl --gitops takeoff
 ```
 
 As soon as the Orbiter has deployed itself to the cluster, you can decrypt the generated admin kubeconfig
 
 ```bash
 mkdir -p ~/.kube
-orbctl readsecret orbiter.k8s.kubeconfig > ~/.kube/config
+orbctl --gitops readsecret orbiter.k8s.kubeconfig > ~/.kube/config
 ```
 
 Wait for grafana to become running
@@ -99,7 +101,7 @@ Delete everything created by Orbiter
 
 ```bash
 # Remove all GCE compute resources
-orbctl destroy
+orbctl --gitops destroy
 
 # Unassign all service account roles
 gcloud projects remove-iam-policy-binding ${MY_GCE_PROJECT} \
@@ -116,10 +118,28 @@ gcloud projects remove-iam-policy-binding ${MY_GCE_PROJECT} \
 gcloud iam service-accounts delete --quiet ${ORBOS_SERVICE_ACCOUNT}
 ```
 
+## Offerings
+
+The usage of our open source code is and stays completely free. Below you will find our base offerings without Service Level. If you'd like to operate ORBOS in production we recommend you to get in touch with us to arrange a Service Level Agreement and benefit from guaranteed availability and response times. For further information or if you need something else, contact us now at [email protected].
+
+### Support
+
+You run an maintain your Orbs yourself. Your incidents are treated with a high priority. In return, we charge you with a price from CHF 250 per Orb and Month, decreasing to CHF 100.
+
+### Dedicated Orbs
+
+We run and maintain your Orbs on a supported provider of your choice. Your incidents are treated with a high priority. In return, we charge you with a price from CHF 500 per Orb and Month, decreasing to CHF 100.
+
+## Usage Data
+
+ORBOS components send errors and usage data to CAOS Ltd., so that we are able to identify code improvement potential. If you don't want to send this data or don't have an internet connection, pass the global flag `--disable-analytics` when using orbctl. For disabling ingestion for already-running components, execute the takeoff command again with the `--disable-analytics` flag.
+
+We try to distinguishing the environments from which events come from. As environment identifier, we defer the environment identifier from your git repository URL if the --gitops flag is passed.
 
+Besides from errors that don't clearly come from misconfiguration or cli misuage, we send an inital event when any binary is started. This is a "<component> invoked" event along with the flags that are passed to it, except secret values of course.
 ## License
 
-The full functionality of the operator is and stays open source and free to use for everyone. We pay our wages by using Orbiter for selling further workload enterprise services like support, monitoring and forecasting, IAM, CI/CD, secrets management etc. Visit our [website](https://caos.ch) and get in touch.
+The full functionality of the operator is and stays open source and free to use for everyone. We pay our wages by using ORBOS for selling further workload enterprise services like support, monitoring and forecasting, IAM, CI/CD, secrets management etc. Visit our [website](https://caos.ch) and get in touch.
 
 See the exact licensing terms [here](./LICENSE)
 

SECURITY.md

@@ -4,11 +4,15 @@ At CAOS we are extremely grateful for security aware people that disclose vulner
 
 ## Supported Versions
 
-After the initial Release the following version support will apply
+The following version support applies
 
 | Version | Supported                               |
 | ------- | ------------------                      |
-| 1.x.x   | :white_check_mark: (not yet available)  |
+| 5.x.x   | :white_check_mark:  |
+| 4.x.x   | :white_check_mark:  |
+| 3.x.x   | :white_check_mark:  |
+| 2.x.x   | :white_check_mark:                      |
+| 1.x.x   | :white_check_mark:                      |
 | 0.x.x   | :x:                                     |
 
 ## Reporting a vulnerability
@@ -40,4 +44,3 @@ All accepted and mitigated vulnerabilitys will be published on the [Github Secur
 ### Timing
 
 We think it is crucial to publish advisories `ASAP` as mitigations are ready. But due to the unknown nature of the discloures the time frame can range from 7 to 90 days.
-

Dockerfile → build/orbos/Dockerfile

@@ -1,7 +1,7 @@
-FROM golang:1.14.4-alpine3.11 as build
+FROM golang:1.16-alpine3.14 as build
 
 RUN apk update && \
-    apk add -U --no-cache ca-certificates git curl openssh && \
+    apk add -U --no-cache ca-certificates git curl openssh build-base && \
     go get github.com/go-delve/delve/cmd/dlv
 
 # Runtime dependencies
@@ -11,7 +11,7 @@ RUN mkdir /dependencies && \
     curl -LO https://storage.googleapis.com/kubernetes-release/release/v1.17.0/bin/linux/amd64/kubectl && \
     chmod +x ./kubectl && \
     mv ./kubectl /dependencies/kubectl && \
-    curl -L "https://get.helm.sh/helm-v2.12.0-linux-amd64.tar.gz" |tar xvz && \
+    curl -L "https://get.helm.sh/helm-v2.17.0-linux-amd64.tar.gz" |tar xvz && \
     mv linux-amd64/helm /dependencies/helm && \
     chmod +x /dependencies/helm
 
@@ -28,10 +28,9 @@ ENV PATH="/dependencies:${PATH}"
 
 ENTRYPOINT [ "dlv", "exec", "/orbctl", "--api-version", "2", "--headless", "--listen", "127.0.0.1:2345", "--" ]
 
-FROM python:3.8.3-alpine3.11 as prod
+FROM alpine:3.13.1 as prod
 
 RUN apk update && \
-    apk add openssh && \
     addgroup -S -g 1000 orbiter && \
     adduser -S -u 1000 orbiter -G orbiter