|
|
|
@@ -1,106 +1,128 @@
|
|
|
|
|
apiVersion: tekton.dev/v1
|
|
|
|
|
kind: Task
|
|
|
|
|
metadata:
|
|
|
|
|
annotations:
|
|
|
|
|
kubectl.kubernetes.io/last-applied-configuration: |
|
|
|
|
|
{"apiVersion":"tekton.dev/v1beta1","kind":"Task","metadata":{"annotations":{"tekton.dev/categories":"Image Build","tekton.dev/pipelines.minVersion":"0.17.0","tekton.dev/platforms":"linux/amd64,linux/s390x,linux/ppc64le,linux/arm64","tekton.dev/tags":"image-build"},"labels":{"app.kubernetes.io/version":"0.5"},"name":"buildah","namespace":"default"},"spec":{"description":"Buildah task builds source into a container image and then pushes it to a container registry.\nBuildah Task builds source into a container image using Project Atomic's Buildah build tool.It uses Buildah's support for building from Dockerfiles, using its buildah bud command.This command executes the directives in the Dockerfile to assemble a container image, then pushes that image to a container registry.","params":[{"description":"Reference of the image buildah will produce.","name":"IMAGE"},{"default":"quay.io/buildah/stable:v1.23.3","description":"The location of the buildah builder image.","name":"BUILDER_IMAGE"},{"default":"overlay","description":"Set buildah storage driver","name":"STORAGE_DRIVER"},{"default":"./Dockerfile","description":"Path to the Dockerfile to build.","name":"DOCKERFILE"},{"default":".","description":"Path to the directory to use as context.","name":"CONTEXT"},{"default":"true","description":"Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)","name":"TLSVERIFY"},{"default":"oci","description":"The format of the built container, oci or docker","name":"FORMAT"},{"default":"","description":"Extra parameters passed for the build command when building images.","name":"BUILD_EXTRA_ARGS"},{"default":"","description":"Extra parameters passed for the push command when pushing images.","name":"PUSH_EXTRA_ARGS","type":"string"},{"default":"false","description":"Skip pushing the built image","name":"SKIP_PUSH"}],"results":[{"description":"Digest of the image just built.","name":"IMAGE_DIGEST"},{"description":"Image repository where the built image would be pushed to","name":"IMAGE_URL"}],"steps":[{"image":"$(params.BUILDER_IMAGE)","name":"build","script":"[[ \"$(workspaces.sslcertdir.bound)\" == \"true\" ]] \u0026\u0026 CERT_DIR_FLAG=\"--cert-dir $(workspaces.sslcertdir.path)\"\n[[ \"$(workspaces.dockerconfig.bound)\" == \"true\" ]] \u0026\u0026 export DOCKER_CONFIG=\"$(workspaces.dockerconfig.path)\"\nbuildah ${CERT_DIR_FLAG} --storage-driver=$(params.STORAGE_DRIVER) bud \\\n $(params.BUILD_EXTRA_ARGS) --format=$(params.FORMAT) \\\n --tls-verify=$(params.TLSVERIFY) --no-cache \\\n -f $(params.DOCKERFILE) -t $(params.IMAGE) $(params.CONTEXT)\n[[ \"$(params.SKIP_PUSH)\" == \"true\" ]] \u0026\u0026 echo \"Push skipped\" \u0026\u0026 exit 0\nbuildah ${CERT_DIR_FLAG} --storage-driver=$(params.STORAGE_DRIVER) push \\\n $(params.PUSH_EXTRA_ARGS) --tls-verify=$(params.TLSVERIFY) \\\n --digestfile /tmp/image-digest $(params.IMAGE) \\\n docker://$(params.IMAGE)\ncat /tmp/image-digest | tee $(results.IMAGE_DIGEST.path)\necho -n \"$(params.IMAGE)\" | tee $(results.IMAGE_URL.path)\n","securityContext":{"privileged":true},"volumeMounts":[{"mountPath":"/var/lib/containers","name":"varlibcontainers"}],"workingDir":"$(workspaces.source.path)"}],"volumes":[{"emptyDir":{},"name":"varlibcontainers"}],"workspaces":[{"name":"source"},{"name":"sslcertdir","optional":true},{"description":"An optional workspace that allows providing a .docker/config.json file for Buildah to access the container registry. The file should be placed at the root of the Workspace with name config.json.","name":"dockerconfig","optional":true}]}}
|
|
|
|
|
tekton.dev/categories: Image Build
|
|
|
|
|
tekton.dev/pipelines.minVersion: 0.17.0
|
|
|
|
|
tekton.dev/platforms: linux/amd64,linux/s390x,linux/ppc64le,linux/arm64
|
|
|
|
|
tekton.dev/tags: image-build
|
|
|
|
|
creationTimestamp: "2024-02-28T10:37:30Z"
|
|
|
|
|
generation: 1
|
|
|
|
|
labels:
|
|
|
|
|
app.kubernetes.io/version: "0.5"
|
|
|
|
|
name: buildah
|
|
|
|
|
namespace: default
|
|
|
|
|
resourceVersion: "670600"
|
|
|
|
|
uid: be7a4925-c0ff-4397-8056-2842f9844108
|
|
|
|
|
labels:
|
|
|
|
|
app.kubernetes.io/version: "0.9"
|
|
|
|
|
annotations:
|
|
|
|
|
tekton.dev/categories: Image Build
|
|
|
|
|
tekton.dev/pipelines.minVersion: "0.50.0"
|
|
|
|
|
tekton.dev/tags: image-build
|
|
|
|
|
tekton.dev/platforms: "linux/amd64,linux/s390x,linux/ppc64le,linux/arm64"
|
|
|
|
|
tekton.dev/displayName: buildah
|
|
|
|
|
spec:
|
|
|
|
|
description: |-
|
|
|
|
|
Buildah task builds source into a container image and then pushes it to a container registry.
|
|
|
|
|
Buildah Task builds source into a container image using Project Atomic's Buildah build tool.It uses Buildah's support for building from Dockerfiles, using its buildah bud command.This command executes the directives in the Dockerfile to assemble a container image, then pushes that image to a container registry.
|
|
|
|
|
description: >-
|
|
|
|
|
Buildah task builds source into a container image and
|
|
|
|
|
then pushes it to a container registry.
|
|
|
|
|
|
|
|
|
|
Buildah Task builds source into a container image using Project Atomic's
|
|
|
|
|
Buildah build tool.It uses Buildah's support for building from Dockerfiles,
|
|
|
|
|
using its buildah bud command.This command executes the directives in the
|
|
|
|
|
Dockerfile to assemble a container image, then pushes that image to a
|
|
|
|
|
container registry.
|
|
|
|
|
|
|
|
|
|
params:
|
|
|
|
|
- description: Reference of the image buildah will produce.
|
|
|
|
|
name: IMAGE
|
|
|
|
|
type: string
|
|
|
|
|
- default: quay.io/buildah/stable:v1.23.3
|
|
|
|
|
- name: IMAGE
|
|
|
|
|
description: Reference of the image buildah will produce.
|
|
|
|
|
- name: BUILDER_IMAGE
|
|
|
|
|
description: The location of the buildah builder image.
|
|
|
|
|
name: BUILDER_IMAGE
|
|
|
|
|
type: string
|
|
|
|
|
- default: overlay
|
|
|
|
|
default: quay.io/buildah/stable:v1
|
|
|
|
|
- name: STORAGE_DRIVER
|
|
|
|
|
description: Set buildah storage driver
|
|
|
|
|
name: STORAGE_DRIVER
|
|
|
|
|
type: string
|
|
|
|
|
- default: ./Dockerfile
|
|
|
|
|
default: overlay
|
|
|
|
|
- name: DOCKERFILE
|
|
|
|
|
description: Path to the Dockerfile to build.
|
|
|
|
|
name: DOCKERFILE
|
|
|
|
|
type: string
|
|
|
|
|
- default: .
|
|
|
|
|
default: ./Dockerfile
|
|
|
|
|
- name: CONTEXT
|
|
|
|
|
description: Path to the directory to use as context.
|
|
|
|
|
name: CONTEXT
|
|
|
|
|
type: string
|
|
|
|
|
- default: "true"
|
|
|
|
|
description: Verify the TLS on the registry endpoint (for push/pull to a non-TLS
|
|
|
|
|
registry)
|
|
|
|
|
name: TLSVERIFY
|
|
|
|
|
type: string
|
|
|
|
|
- default: oci
|
|
|
|
|
default: .
|
|
|
|
|
- name: TLSVERIFY
|
|
|
|
|
description: Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)
|
|
|
|
|
default: "false"
|
|
|
|
|
- name: FORMAT
|
|
|
|
|
description: The format of the built container, oci or docker
|
|
|
|
|
name: FORMAT
|
|
|
|
|
default: "oci"
|
|
|
|
|
- name: BUILD_EXTRA_ARGS
|
|
|
|
|
description: Extra parameters passed for the build command when building images. WARNING - must be sanitized to avoid command injection
|
|
|
|
|
default: ""
|
|
|
|
|
- name: PUSH_EXTRA_ARGS
|
|
|
|
|
description: Extra parameters passed for the push command when pushing images. WARNING - must be sanitized to avoid command injection
|
|
|
|
|
type: string
|
|
|
|
|
- default: ""
|
|
|
|
|
description: Extra parameters passed for the build command when building images.
|
|
|
|
|
name: BUILD_EXTRA_ARGS
|
|
|
|
|
type: string
|
|
|
|
|
- default: ""
|
|
|
|
|
description: Extra parameters passed for the push command when pushing images.
|
|
|
|
|
name: PUSH_EXTRA_ARGS
|
|
|
|
|
type: string
|
|
|
|
|
- default: "false"
|
|
|
|
|
default: ""
|
|
|
|
|
- name: SKIP_PUSH
|
|
|
|
|
description: Skip pushing the built image
|
|
|
|
|
name: SKIP_PUSH
|
|
|
|
|
type: string
|
|
|
|
|
results:
|
|
|
|
|
- description: Digest of the image just built.
|
|
|
|
|
name: IMAGE_DIGEST
|
|
|
|
|
type: string
|
|
|
|
|
- description: Image repository where the built image would be pushed to
|
|
|
|
|
name: IMAGE_URL
|
|
|
|
|
type: string
|
|
|
|
|
steps:
|
|
|
|
|
- computeResources: {}
|
|
|
|
|
image: $(params.BUILDER_IMAGE)
|
|
|
|
|
name: build
|
|
|
|
|
script: |
|
|
|
|
|
[[ "$(workspaces.sslcertdir.bound)" == "true" ]] && CERT_DIR_FLAG="--cert-dir $(workspaces.sslcertdir.path)"
|
|
|
|
|
[[ "$(workspaces.dockerconfig.bound)" == "true" ]] && export DOCKER_CONFIG="$(workspaces.dockerconfig.path)"
|
|
|
|
|
buildah ${CERT_DIR_FLAG} --storage-driver=$(params.STORAGE_DRIVER) bud \
|
|
|
|
|
$(params.BUILD_EXTRA_ARGS) --format=$(params.FORMAT) \
|
|
|
|
|
--tls-verify=$(params.TLSVERIFY) --no-cache \
|
|
|
|
|
-f $(params.DOCKERFILE) -t $(params.IMAGE) $(params.CONTEXT)
|
|
|
|
|
[[ "$(params.SKIP_PUSH)" == "true" ]] && echo "Push skipped" && exit 0
|
|
|
|
|
buildah ${CERT_DIR_FLAG} --storage-driver=$(params.STORAGE_DRIVER) push \
|
|
|
|
|
$(params.PUSH_EXTRA_ARGS) --tls-verify=$(params.TLSVERIFY) \
|
|
|
|
|
--digestfile /tmp/image-digest $(params.IMAGE) \
|
|
|
|
|
docker://$(params.IMAGE)
|
|
|
|
|
cat /tmp/image-digest | tee $(results.IMAGE_DIGEST.path)
|
|
|
|
|
echo -n "$(params.IMAGE)" | tee $(results.IMAGE_URL.path)
|
|
|
|
|
securityContext:
|
|
|
|
|
privileged: true
|
|
|
|
|
volumeMounts:
|
|
|
|
|
- mountPath: /var/lib/containers
|
|
|
|
|
name: varlibcontainers
|
|
|
|
|
workingDir: $(workspaces.source.path)
|
|
|
|
|
volumes:
|
|
|
|
|
- emptyDir: {}
|
|
|
|
|
name: varlibcontainers
|
|
|
|
|
default: "false"
|
|
|
|
|
- name: BUILD_ARGS
|
|
|
|
|
description: Dockerfile build arguments, array of key=value
|
|
|
|
|
type: array
|
|
|
|
|
default:
|
|
|
|
|
- ""
|
|
|
|
|
workspaces:
|
|
|
|
|
- name: source
|
|
|
|
|
- name: sslcertdir
|
|
|
|
|
optional: true
|
|
|
|
|
- description: An optional workspace that allows providing a .docker/config.json
|
|
|
|
|
file for Buildah to access the container registry. The file should be placed
|
|
|
|
|
at the root of the Workspace with name config.json.
|
|
|
|
|
name: dockerconfig
|
|
|
|
|
- name: dockerconfig
|
|
|
|
|
description: >-
|
|
|
|
|
An optional workspace that allows providing a .docker/config.json file
|
|
|
|
|
for Buildah to access the container registry.
|
|
|
|
|
The file should be placed at the root of the Workspace with name config.json.
|
|
|
|
|
optional: true
|
|
|
|
|
results:
|
|
|
|
|
- name: IMAGE_DIGEST
|
|
|
|
|
description: Digest of the image just built.
|
|
|
|
|
- name: IMAGE_URL
|
|
|
|
|
description: Image repository where the built image would be pushed to
|
|
|
|
|
steps:
|
|
|
|
|
- name: build-and-push
|
|
|
|
|
image: $(params.BUILDER_IMAGE)
|
|
|
|
|
workingDir: $(workspaces.source.path)
|
|
|
|
|
env:
|
|
|
|
|
- name: PARAM_IMAGE
|
|
|
|
|
value: $(params.IMAGE)
|
|
|
|
|
- name: PARAM_STORAGE_DRIVER
|
|
|
|
|
value: $(params.STORAGE_DRIVER)
|
|
|
|
|
- name: PARAM_DOCKERFILE
|
|
|
|
|
value: $(params.DOCKERFILE)
|
|
|
|
|
- name: PARAM_CONTEXT
|
|
|
|
|
value: $(params.CONTEXT)
|
|
|
|
|
- name: PARAM_TLSVERIFY
|
|
|
|
|
value: $(params.TLSVERIFY)
|
|
|
|
|
- name: PARAM_FORMAT
|
|
|
|
|
value: $(params.FORMAT)
|
|
|
|
|
- name: PARAM_BUILD_EXTRA_ARGS
|
|
|
|
|
value: $(params.BUILD_EXTRA_ARGS)
|
|
|
|
|
- name: PARAM_PUSH_EXTRA_ARGS
|
|
|
|
|
value: $(params.PUSH_EXTRA_ARGS)
|
|
|
|
|
- name: PARAM_SKIP_PUSH
|
|
|
|
|
value: $(params.SKIP_PUSH)
|
|
|
|
|
args:
|
|
|
|
|
- $(params.BUILD_ARGS[*])
|
|
|
|
|
script: |
|
|
|
|
|
BUILD_ARGS=()
|
|
|
|
|
for buildarg in "$@"
|
|
|
|
|
do
|
|
|
|
|
BUILD_ARGS+=("--build-arg=$buildarg")
|
|
|
|
|
done
|
|
|
|
|
[ "$(workspaces.sslcertdir.bound)" = "true" ] && CERT_DIR_FLAG="--cert-dir=$(workspaces.sslcertdir.path)"
|
|
|
|
|
[ "$(workspaces.dockerconfig.bound)" = "true" ] && DOCKER_CONFIG="$(workspaces.dockerconfig.path)" && export DOCKER_CONFIG
|
|
|
|
|
# build the image (CERT_DIR_FLAG should be omitted if empty and BUILD_EXTRA_ARGS can contain multiple args)
|
|
|
|
|
# shellcheck disable=SC2046,SC2086
|
|
|
|
|
buildah ${CERT_DIR_FLAG} "--storage-driver=${PARAM_STORAGE_DRIVER}" bud "${BUILD_ARGS[@]}" ${PARAM_BUILD_EXTRA_ARGS} \
|
|
|
|
|
"--format=${PARAM_FORMAT}" "--tls-verify=${PARAM_TLSVERIFY}" \
|
|
|
|
|
-f "${PARAM_DOCKERFILE}" -t "${PARAM_IMAGE}" "${PARAM_CONTEXT}"
|
|
|
|
|
[ "${PARAM_SKIP_PUSH}" = "true" ] && echo "Push skipped" && exit 0
|
|
|
|
|
# push the image (CERT_DIR_FLAG should be omitted if empty and PUSH_EXTRA_ARGS can contain multiple args)
|
|
|
|
|
# shellcheck disable=SC2046,SC2086
|
|
|
|
|
buildah ${CERT_DIR_FLAG} "--storage-driver=${PARAM_STORAGE_DRIVER}" push \
|
|
|
|
|
"--tls-verify=${PARAM_TLSVERIFY}" --digestfile /tmp/image-digest ${PARAM_PUSH_EXTRA_ARGS} \
|
|
|
|
|
"${PARAM_IMAGE}" "docker://${PARAM_IMAGE}"
|
|
|
|
|
tee "$(results.IMAGE_DIGEST.path)" < /tmp/image-digest
|
|
|
|
|
printf '%s' "${PARAM_IMAGE}" | tee "$(results.IMAGE_URL.path)"
|
|
|
|
|
volumeMounts:
|
|
|
|
|
- name: varlibcontainers
|
|
|
|
|
mountPath: /var/lib/containers
|
|
|
|
|
securityContext:
|
|
|
|
|
privileged: true
|
|
|
|
|
volumes:
|
|
|
|
|
- name: varlibcontainers
|
|
|
|
|
emptyDir: {}
|
|
|
|
|
allard