Update release test cron job (#778)

Co-authored-by: Azeem Shaikh <azeems@google.com>

cron/controller/Dockerfile

@@ -26,6 +26,6 @@ ARG TARGETARCH
 RUN CGO_ENABLED=0 make build-pubsub
 
 FROM gcr.io/distroless/base:nonroot@sha256:bc84925113289d139a9ef2f309f0dd7ac46ea7b786f172ba9084ffdb4cbd9490
-COPY ./cron/data/projects.csv /cron/data/projects.csv
-COPY --from=pubsub /src/cron/controller/controller ./cron/controller/controller
-ENTRYPOINT ["./cron/controller/controller", "./cron/data/projects.csv"]
+COPY ./cron/data/projects.csv cron/data/projects.csv
+COPY --from=pubsub /src/cron/controller/controller cron/controller/controller
+ENTRYPOINT ["cron/controller/controller", "cron/data/projects.csv"]

cron/releasetest/k8s/controller.yaml

@@ -12,6 +12,30 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: scorecard-batch-controller-releasetest
+rules:
+  - apiGroups: ["apps", "extensions"]
+    resources: ["deployments"]
+    resourceNames: ["scorecard-batch-worker-releasetest"]
+    verbs: ["get", "patch"]
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: scorecard-batch-controller-releasetest
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: scorecard-batch-controller-releasetest
+subjects:
+  - kind: ServiceAccount
+    name: default
+---
+
 apiVersion: batch/v1beta1
 kind: CronJob
 metadata:
@@ -24,6 +48,7 @@ spec:
     spec:
       template:
         spec:
+          restartPolicy: Never
           containers:
           - name: controller
             image: gcr.io/openssf/scorecard-batch-controller-releasetest:latest
@@ -40,4 +65,10 @@ spec:
                 memory: 1Gi
               requests:
                 memory: 1Gi
-          restartPolicy: OnFailure
+          - name: worker-update
+            image: bitnami/kubectl@sha256:44468c0f5b348e6dcf5e11feb6fdcc969c874bba2856150fe50eb1aacb3bdfee
+            command:
+              - "kubectl"
+              - "rollout"
+              - "restart"
+              - "deployment/scorecard-batch-worker-releasetest"

cron/releasetest/worker/Dockerfile

@@ -26,5 +26,5 @@ ARG TARGETARCH
 RUN CGO_ENABLED=0 make build-pubsub
 
 FROM gcr.io/distroless/base:nonroot@sha256:bc84925113289d139a9ef2f309f0dd7ac46ea7b786f172ba9084ffdb4cbd9490
-COPY --from=pubsub /src/cron/worker/worker ./cron/worker/worker
-ENTRYPOINT ["./cron/worker/worker"]
+COPY --from=pubsub /src/cron/worker/worker cron/worker/worker
+ENTRYPOINT ["cron/worker/worker"]

cron/worker/Dockerfile

@@ -26,5 +26,5 @@ ARG TARGETARCH
 RUN CGO_ENABLED=0 make build-pubsub
 
 FROM gcr.io/distroless/base:nonroot@sha256:bc84925113289d139a9ef2f309f0dd7ac46ea7b786f172ba9084ffdb4cbd9490
-COPY --from=pubsub /src/cron/worker/worker ./cron/worker/worker
-ENTRYPOINT ["./cron/worker/worker"]
+COPY --from=pubsub /src/cron/worker/worker cron/worker/worker
+ENTRYPOINT ["cron/worker/worker"]