SlyngDK · SlyngDK · Sep 20, 2025 · Sep 20, 2025 · Sep 20, 2025 · Sep 20, 2025
diff --git a/.dockerignore b/.dockerignore
@@ -1,5 +1,6 @@
 # More info: https://docs.docker.com/engine/reference/builder/#dockerignore-file
 # Ignore build and test binaries.
+*
 !api/
 !cmd/
 !examples/

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -18,10 +18,6 @@ on:
       - '*.adoc'
       - '*.txt'
 
-env:
-  IMG_REGISTRY: ghcr.io/slyngdk/
-  IMG_NAME_CONTROLLER: nodedrain-controller
-  IMG_NAME_EXAM_PLUGIN: nodedrain-example-plugin
 
 jobs:
   container-build:
@@ -32,9 +28,12 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v2
+      - uses: ./.github/workflows/env_setup
+        with:
+          docker_cache_enabled: true
 
       - name: Login to GitHub Container Registry
-        if: github.ref == 'refs/heads/main' || (github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/v'))
+        if: env.PROTECTED_RUN == 'true'
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -52,50 +51,7 @@ jobs:
           fi
           export IMG_TAG=${IMG_TAG//\//-}
           echo "IMG_TAG=${IMG_TAG}" >> $GITHUB_OUTPUT
-          make docker-build
-
-      - name: Push image
-        if: github.ref == 'refs/heads/main' || (github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/v'))
-        env:
-          IMG_TAG: ${{ steps.build_image.outputs.IMG_TAG }}
-        run: |
-          if [[ "${{ github.ref_type }}" == "branch" && "${{ github.ref_name }}" != "main" ]] || [[ "${{ github.ref_type }}" == "tag" && ! "${{ github.ref_name }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Only push main branch and versioned tags"
-            exit 1
-          fi
-          make docker-push
-
-  helm-package:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
-
-      - name: Install Helm
-        run: |
-          curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
-
-      - name: Verify Helm installation
-        run: helm version
-
-      - name: Login to GitHub Container Registry
-        if: github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/v')
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Helm package
-        run: |
-          export VERSION=999
-          if [[ "${{ github.ref_type }}" == "tag" && "${{ github.ref_name }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            export VERSION=$(echo -n "${{ github.ref_name }}" | sed 's/^v//g')
-          fi
-          helm package dist/chart -u --version ${VERSION} --app-version ${VERSION}
-          if [[ "${VERSION}" != "999" ]]; then
-            helm push "nodedrain-${VERSION}.tgz" "oci://ghcr.io/slyngdk/charts"
+          if [[ "${PROTECTED_RUN}" == "true" ]]; then
+            export DOCKER_BUILD_OPTIONS="--push"
           fi
+          make docker-build
diff --git a/.github/workflows/env_setup/action.yml b/.github/workflows/env_setup/action.yml
@@ -0,0 +1,64 @@
+inputs:
+  docker_cache_enabled:
+    required: true
+    default: false
+
+runs:
+  using: "composite"
+  steps:
+    - shell: bash
+      run: |
+        echo "PROTECTED_RUN=false" >> $GITHUB_ENV
+        echo "IMG_REGISTRY=ghcr.io/slyngdk/" >> $GITHUB_ENV
+        echo "IMG_NAME_CONTROLLER=nodedrain-controller" >> $GITHUB_ENV
+        echo "IMG_NAME_EXAM_PLUGIN=nodedrain-example-plugin" >> $GITHUB_ENV
+        echo "BRANCH_NAME=${{ github.head_ref || github.ref_name }}" >> $GITHUB_ENV
+        echo "BRANCH_NAME_HASH=$(echo -n ${{ github.head_ref || github.ref_name }} | md5sum | cut -d" " -f1 -z)" >> $GITHUB_ENV
+
+    - shell: bash
+      if: (github.ref == 'refs/heads/main' || (github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/v'))) && !env.ACT
+      run: |
+        echo "PROTECTED_RUN=true" >> $GITHUB_ENV
+
+    - shell: bash
+      if: inputs.docker_cache_enabled == 'true'
+      run: |
+        echo "DOCKER_BUILD_OPTIONS_CONTROLLER=--cache-to type=gha,mode=max,scope=controller-${{ env.BRANCH_NAME_HASH }} --cache-from type=gha,scope=controller-${{ env.BRANCH_NAME_HASH }} --cache-from type=gha,scope=controller-main" >> $GITHUB_ENV
+        echo "DOCKER_BUILD_OPTIONS_EXAM_PLUGIN=--cache-to type=gha,mode=max,scope=example-plugin-${{ env.BRANCH_NAME_HASH }} --cache-from type=gha,scope=example-plugin-${{ env.BRANCH_NAME_HASH }} --cache-from type=gha,scope=example-plugin-main" >> $GITHUB_ENV
+
+    - uses: docker/setup-buildx-action@v3
+      if: inputs.docker_cache_enabled == 'true'
+      id: setup-buildx
+
+    - name: Calculate Docker image context hash
+      id: context-hash
+      uses: 5monkeys/docker-image-context-hash-action@v2.0.0
+      if: inputs.docker_cache_enabled == 'true'
+      with:
+        extra_tree_objects: |
+          .dockerignore
+          Dockerfile
+
+    - name: Go Build Cache for Docker
+      uses: actions/cache@v4
+      if: inputs.docker_cache_enabled == 'true'
+      id: cache
+      with:
+        path: go-build-cache
+        key: ${{ runner.os }}-go-build-cache-${{ env.BRANCH_NAME_HASH }}-${{ steps.context-hash.outputs.hash }}
+        restore-keys: |
+          ${{ runner.os }}-go-build-cache-${{ env.BRANCH_NAME_HASH }}-
+          ${{ runner.os }}-go-build-cache-main-
+
+    - name: Restore Docker cache mounts
+      uses: reproducible-containers/buildkit-cache-dance@v3.3.0
+      if: inputs.docker_cache_enabled == 'true'
+      with:
+        builder: ${{ steps.setup-buildx.outputs.name }}
+        cache-dir: go-build-cache
+        dockerfile: Dockerfile
+        skip-extraction: ${{ steps.cache.outputs.cache-hit }}
+
+    - name: Expose GitHub Runtime
+      uses: crazy-max/ghaction-github-runtime@v3
+      if: inputs.docker_cache_enabled == 'true' && !env.ACT
diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml
@@ -0,0 +1,56 @@
+name: Helm package
+on:
+  push:
+    paths-ignore:
+      - '.gitignore'
+      - 'CODEOWNERS'
+      - 'LICENSE'
+      - '*.md'
+      - '*.adoc'
+      - '*.txt'
+  pull_request:
+    paths-ignore:
+      - '.gitignore'
+      - 'CODEOWNERS'
+      - 'LICENSE'
+      - '*.md'
+      - '*.adoc'
+      - '*.txt'
+
+
+jobs:
+  helm-package:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+      - uses: ./.github/workflows/env_setup
+
+      - name: Install Helm
+        run: |
+          curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+
+      - name: Verify Helm installation
+        run: helm version
+
+      - name: Login to GitHub Container Registry
+        if: env.PROTECTED_RUN == 'true'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Helm package
+        run: |
+          export VERSION=999
+          if [[ "${{ github.ref_type }}" == "tag" && "${{ github.ref_name }}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            export VERSION=$(echo -n "${{ github.ref_name }}" | sed 's/^v//g')
+          fi
+          helm package dist/chart -u --version ${VERSION} --app-version ${VERSION}
+          if [[ "${VERSION}" != "999" && "${PROTECTED_RUN}" == "true" ]]; then
+            helm push "nodedrain-${VERSION}.tgz" "oci://ghcr.io/slyngdk/charts"
+          fi
diff --git a/.github/workflows/test-chart.yml b/.github/workflows/test-chart.yml
@@ -19,9 +19,6 @@ on:
       - '*.txt'
 
 env:
-  IMG_REGISTRY: ghcr.io/slyngdk/
-  IMG_NAME_CONTROLLER: nodedrain-controller
-  IMG_NAME_EXAM_PLUGIN: nodedrain-example-plugin
   IMG_TAG: test-chart
   KIND_CLUSTER_NAME: nodedrain-test-chart
 
@@ -32,10 +29,9 @@ jobs:
       - name: Clone the code
         uses: actions/checkout@v4
 
-      - name: Setup Go
-        uses: actions/setup-go@v5
+      - uses: ./.github/workflows/env_setup
         with:
-          go-version-file: go.mod
+          docker_cache_enabled: true
 
       - name: Install the latest version of kind
         run: |
@@ -53,7 +49,7 @@ jobs:
 
       - name: Prepare nodedrain
         run: |
-          make docker-build
+          make docker-build DOCKER_BUILD_OPTIONS=--load
           kind load docker-image ${IMG_REGISTRY}${IMG_NAME_CONTROLLER}:${IMG_TAG}
 
       - name: Install Helm

diff --git a/.github/workflows/test-e2e.yml b/.github/workflows/test-e2e.yml
@@ -26,6 +26,10 @@ jobs:
       - name: Clone the code
         uses: actions/checkout@v4
 
+      - uses: ./.github/workflows/env_setup
+        with:
+          docker_cache_enabled: true
+
       - name: Setup Go
         uses: actions/setup-go@v5
         with:
@@ -42,5 +46,4 @@ jobs:
 
       - name: Running Test e2e
         run: |
-          go mod tidy
           make test-e2e
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -30,7 +30,10 @@ jobs:
         with:
           go-version-file: go.mod
 
+      - name: Checking go mod tidy
+        run: |
+          go mod tidy -diff
+
       - name: Running Tests
         run: |
-          go mod tidy
           make test
diff --git a/Dockerfile b/Dockerfile
@@ -9,7 +9,7 @@ COPY go.mod go.mod
 COPY go.sum go.sum
 # cache deps before building and copying source so that we don't need to re-download as much
 # and so that source changes don't invalidate our downloaded layer
-RUN go mod download
+RUN --mount=type=cache,target=/root/.cache go mod download
 
 # Copy the go source
 COPY cmd/main.go cmd/main.go
@@ -38,7 +38,7 @@ CMD ["cp", "-v", "/example-plugin.so", "/plugins/example-plugin.so"]
 
 # Use distroless as minimal base image to package the manager binary
 # Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:debug-nonroot AS controller
+FROM gcr.io/distroless/static:nonroot AS controller
 WORKDIR /
 COPY --from=builder /workspace/manager .
 USER 65532:65532

diff --git a/Makefile b/Makefile
@@ -7,13 +7,6 @@ KUBE_CONTEXT ?= kind-nodedrain-test-e2e
 KUSTOMIZE_CONFIG ?= default
 IMG_REGISTRY_FULL := $(if ${IMG_REGISTRY},$(patsubst %/,%,${IMG_REGISTRY})/)
 
-# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
-ifeq (,$(shell go env GOBIN))
-GOBIN=$(shell go env GOPATH)/bin
-else
-GOBIN=$(shell go env GOBIN)
-endif
-
 # CONTAINER_TOOL defines the container tool to be used for building images.
 # Be aware that the target commands are only tested with Docker which is
 # scaffolded by default. However, you might want to replace it to use other
@@ -126,14 +119,9 @@ run: manifests generate fmt vet ## Run a controller from your host.
 # (i.e. docker build --platform linux/arm64). However, you must enable docker buildKit for it.
 # More info: https://docs.docker.com/develop/develop-images/build_enhancements/
 .PHONY: docker-build
-docker-build: ## Build docker image with the manager.
-	$(CONTAINER_TOOL) build --target controller -t $(IMG_REGISTRY_FULL)$(IMG_NAME_CONTROLLER):$(IMG_TAG) .
-	$(CONTAINER_TOOL) build --target example-plugin -t $(IMG_REGISTRY_FULL)$(IMG_NAME_EXAM_PLUGIN):$(IMG_TAG) .
-
-.PHONY: docker-push
-docker-push: ## Push docker image with the manager.
-	$(CONTAINER_TOOL) push $(IMG_REGISTRY_FULL)$(IMG_NAME_CONTROLLER):$(IMG_TAG)
-	$(CONTAINER_TOOL) push $(IMG_REGISTRY_FULL)$(IMG_NAME_EXAM_PLUGIN):$(IMG_TAG)
+docker-build:
+	$(CONTAINER_TOOL) buildx build --target controller $(DOCKER_BUILD_OPTIONS) $(DOCKER_BUILD_OPTIONS_CONTROLLER) -t $(IMG_REGISTRY_FULL)$(IMG_NAME_CONTROLLER):$(IMG_TAG) .
+	$(CONTAINER_TOOL) buildx build --target example-plugin $(DOCKER_BUILD_OPTIONS) $(DOCKER_BUILD_OPTIONS_EXAM_PLUGIN) -t $(IMG_REGISTRY_FULL)$(IMG_NAME_EXAM_PLUGIN):$(IMG_TAG) .
 
 # PLATFORMS defines the target platforms for the manager image be built to provide support to multiple
 # architectures. (i.e. make docker-buildx IMG=myregistry/mypoperator IMG_TAG=0.0.1). To use this option you need to:
@@ -281,7 +269,7 @@ minikube-start:
     	minikube start -p nodedrain --embed-certs=true --interactive=false --install-addons=false --nodes=2 ;\
     	minikube -p nodedrain addons enable registry ;\
     };
-	[ ! "$$($(CONTAINER_TOOL) ps -a -q -f name=nodedrain-registry-proxy)" ] &&	$(CONTAINER_TOOL) run --rm -d --name nodedrain-registry-proxy --network=host alpine ash -c "apk add socat && socat TCP-LISTEN:5000,reuseaddr,fork TCP:$$(minikube -p nodedrain ip):5000" || true
+	[ "$$($(CONTAINER_TOOL) ps -a -q -f name=nodedrain-registry-proxy)" ] && true || $(CONTAINER_TOOL) run --rm -d --name nodedrain-registry-proxy --network=host alpine ash -c "apk add socat && socat TCP-LISTEN:5000,reuseaddr,fork TCP:$$(minikube -p nodedrain ip):5000"
 	timeout 300 bash -c 'while [[ "$$(curl -s -o /dev/null -w ''%{http_code}'' localhost:5000)" != "200" ]]; do sleep 1; done' || false
 
 
@@ -302,5 +290,5 @@ minikube-cert-manager:
 
 .PHONY: minikube-deploy
 minikube-deploy: manifests generate minikube-start minikube-cert-manager
-	$(MAKE) -e IMG_REGISTRY=localhost:5000/ -e KUBE_CONTEXT=nodedrain -e KUSTOMIZE_CONFIG=dev docker-build docker-push deploy
+	$(MAKE) docker-build deploy IMG_REGISTRY=localhost:5000/ KUBE_CONTEXT=nodedrain KUSTOMIZE_CONFIG=dev DOCKER_BUILD_OPTIONS=--push
 	$(KUBECTL) --context nodedrain rollout restart deployment nodedrain-controller-manager -n nodedrain-system
diff --git a/README.md b/README.md
@@ -67,7 +67,7 @@ make test-e2e
 
 ### Build and push image
 ```bash
-make docker-build docker-push IMG_REGISTRY=localhost:5000 IMG_NAME_CONTROLLER=controller IMG_TAG=latest
+make docker-build IMG_REGISTRY=localhost:5000 IMG_NAME_CONTROLLER=controller IMG_TAG=latest DOCKER_BUILD_OPTIONS=--push
 ```
 
 ### Sample config

diff --git a/test/e2e/e2e_suite_test.go b/test/e2e/e2e_suite_test.go
@@ -46,6 +46,7 @@ var (
 			fmt.Sprintf("IMG_REGISTRY=%s", projectRegistry),
 			fmt.Sprintf("IMG_NAME_CONTROLLER=%s", projectControllerImage),
 			fmt.Sprintf("IMG_TAG=%s", projectImageTag),
+			"DOCKER_BUILD_OPTIONS=--load",
 		}
 	}
 )