Skip to content

operator.md

Latest commit

 

History

History
112 lines (85 loc) · 3.33 KB

operator.md

File metadata and controls

112 lines (85 loc) · 3.33 KB
Raw

vmafx-operator container image

The vmafx-operator is the Kubernetes operator binary that reconciles the VmafxJob, VmafxNode, and VmafxModelTraining custom resource definitions (CRDs). It is published as a signed, SBOM-attested OCI image on every release tag.

ADR reference: ADR-0815, ADR-0714.

Image coordinates

Registry Image Default tag Platforms
ghcr.io vmafx/vmafx-operator latest linux/amd64, linux/arm64

Pull by digest for production deployments:

docker pull ghcr.io/vmafx/vmafx-operator@sha256:<digest>

Verify the Sigstore signature:

cosign verify \
  --certificate-identity-regexp="https://github.com/VMAFx/vmafx/.github/workflows/docker-publish-operator-node.yml" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  ghcr.io/vmafx/vmafx-operator@sha256:<digest>

Build the image locally

docker build \
  -f docker/Dockerfile.operator \
  --target operator \
  -t ghcr.io/vmafx/vmafx-operator:dev \
  .

Multi-arch (requires docker buildx):

docker buildx build \
  -f docker/Dockerfile.operator \
  --target operator \
  --platform linux/amd64,linux/arm64 \
  -t ghcr.io/vmafx/vmafx-operator:dev \
  --push \
  .

Run

docker run --rm \
  -e VMAFX_OPERATOR_METRICS_ADDR=:8081 \
  -e VMAFX_OPERATOR_PROBE_ADDR=:8082 \
  -e VMAFX_OPERATOR_LEADER_ELECT=false \
  -e VMAFX_OPERATOR_LOG_LEVEL=info \
  ghcr.io/vmafx/vmafx-operator:latest

In-cluster the operator reads kubeconfig from the service-account token mounted by Kubernetes. The RBAC rules are managed by the Helm chart (ADR-0699); the image runs as uid 65532 (nonroot) by default.

Environment variables

Variable Default Description
VMAFX_OPERATOR_METRICS_ADDR :8081 Prometheus /metrics endpoint bind address
VMAFX_OPERATOR_PROBE_ADDR :8082 /healthz + /readyz bind address
VMAFX_OPERATOR_LEADER_ELECT false Enable leader election for HA deployments
VMAFX_OPERATOR_LOG_LEVEL info Log verbosity: debug, info, warn, error

CLI flags mirror all environment variables and take precedence.

Exposed ports

Port Protocol Purpose
8081 TCP Prometheus metrics
8082 TCP Health and readiness probes (/healthz, /readyz)

CI release pipeline

The workflow .github/workflows/docker-publish-operator-node.yml fires on every v* tag push (release-please) and on workflow_dispatch. It:

  1. Builds ghcr.io/vmafx/vmafx-operator for linux/amd64 + linux/arm64 using BuildKit native cross-compilation (CGO_ENABLED=0 pure-Go binary; no QEMU needed).
  2. Signs the pushed digest via cosign sign --yes (Sigstore keyless OIDC).
  3. Generates a CycloneDX SBOM with syft and attaches it as a cosign attest predicate.
  4. Uploads the SBOM JSON as a workflow artifact (90-day retention).
  5. Runs a smoke-test (--help) before the aggregator gate passes.

Upgrade

Update the image tag (or digest) in the Helm values.yaml:

operator:
  image:
    repository: ghcr.io/vmafx/vmafx-operator
    tag: "v3.2.0-lusoris.5"

Then run helm upgrade vmafx ./deploy/helm/vmafx -n vmafx-system.