Migrate to new image repositories (#250)

2024-07-19 15:28:15 +01:00
parent 13d67616ae
commit 976fbe762e
9 changed files with 132 additions and 20 deletions
--- a/ci/pipeline.yml
+++ b/ci/pipeline.yml
@@ -20,11 +20,27 @@ jobs:
    plan:
      - get: ci-images-git-repo
        trigger: true
-      - put: spring-credhub-ci-image
+      - task: generate-docker-credentials
+        file: ci-images-git-repo/ci/tasks/generate-docker-credentials.yml
+        input_mapping:
+          git-repo: ci-images-git-repo
+        vars:
+          registry: ((spring-credhub-dev-docker-registry))
+          registry-username: ((broadcom-jfrog-artifactory-robot-account.username))
+          registry-password: ((broadcom-jfrog-artifactory-robot-account.password))
+      - task: build-image
+        privileged: true
+        file: ci-images-git-repo/ci/tasks/build-oci-image.yml
+        input_mapping:
+          git-repo: ci-images-git-repo
        params:
-          build: ci-images-git-repo/ci/images/spring-credhub-ci
-        get_params:
-          skip_download: "true"
+          CONTEXT: git-repo/ci/images/spring-credhub-ci
+      - put: spring-credhub-ci-image
+        inputs: detect
+        params:
+          image: image/image.tar
+        no_get: true
+    on_failure: *slack-failure-notification

  - name: build
    serial: true
@@ -172,13 +188,17 @@ resource_types:
  - name: artifactory-resource
    type: registry-image
    source:
-      repository: ((dockerhub-mirror-registry))/springio/artifactory-resource
+      repository: ((spring-credhub-virtual-docker-registry))/springio/artifactory-resource
+      username: ((broadcom-jfrog-artifactory-robot-account.username))
+      password: ((broadcom-jfrog-artifactory-robot-account.password))
      tag: 0.0.14

  - name: slack-notification
    type: registry-image
    source:
-      repository: ((dockerhub-mirror-registry))/cfcommunity/slack-notification-resource
+      repository: ((spring-credhub-virtual-docker-registry))/cfcommunity/slack-notification-resource
+      username: ((broadcom-jfrog-artifactory-robot-account.username))
+      password: ((broadcom-jfrog-artifactory-robot-account.password))
      tag: latest

 resources:
@@ -197,14 +217,18 @@ resources:
    source:
      uri: ((github-repo))
      branch: ((branch))
-      paths: ["ci/images/*"]
+      paths:
+        - ci/images/*
+        - ci/scripts/generate-docker-credentials.sh
+        - ci/tasks/build-oci-image.yml
+        - ci/tasks/generate-docker-credentials.yml

  - name: spring-credhub-ci-image
-    type: docker-image
+    type: registry-image
    source:
-      repository: ((corporate-harbor-registry))/((dockerhub-organization))/spring-credhub-ci
-      username: ((corporate-harbor-robot-account.username))
-      password: ((corporate-harbor-robot-account.password))
+      repository: ((spring-credhub-dev-docker-registry))/ci/spring-credhub-ci
+      username: ((broadcom-jfrog-artifactory-robot-account.username))
+      password: ((broadcom-jfrog-artifactory-robot-account.password))
      tag: ((ci-image-tag))

  - name: artifactory-repo
--- a/ci/scripts/build-project.sh
+++ b/ci/scripts/build-project.sh
@@ -2,15 +2,33 @@

 set -euo pipefail

+readonly DOCKERHUB_MIRROR_REGISTRY="${DOCKERHUB_MIRROR_REGISTRY:?must be set}"
+readonly DOCKERHUB_MIRROR_REGISTRY_USERNAME="${DOCKERHUB_MIRROR_REGISTRY_USERNAME:?must be set}"
+readonly DOCKERHUB_MIRROR_REGISTRY_PASSWORD="${DOCKERHUB_MIRROR_REGISTRY_PASSWORD:?must be set}"
+
 # shellcheck source=common.sh
 source "$(dirname "$0")/common.sh"
 repository=$(pwd)/distribution-repository

 start_docker() {
  pushd credhub-server >/dev/null
-    echo '{"registry-mirrors": ["https://harbor-mirror.spring.vmware.com"]}' > /etc/docker/daemon.json
+    echo "{\"registry-mirrors\": [\"https://$DOCKERHUB_MIRROR_REGISTRY\"]}" > /etc/docker/daemon.json
    service cgroupfs-mount start
    service docker start
+
+    # Work around https://github.com/moby/moby/issues/30880
+    cat >> /etc/hosts << EOF
+127.0.0.1  index.docker.io
+127.0.0.1  registry-1.docker.io
+127.0.0.1  docker.io
+EOF
+    mkdir -p "$HOME/.docker"
+    jq --arg username "$DOCKERHUB_MIRROR_REGISTRY_USERNAME" \
+      --arg password "$DOCKERHUB_MIRROR_REGISTRY_PASSWORD" \
+      'reduce .[] as $registry ({"auths": {}}; .auths += {($registry): {"auth": [$username, $password] | join(":") | @base64}})' \
+      <<< "[\"index.docker.io\", \"$DOCKERHUB_MIRROR_REGISTRY\"]" \
+      > "$HOME/.docker/config.json"
+
    docker-compose up --detach
    trap "stop_docker" EXIT
  popd >/dev/null
--- a/ci/scripts/generate-docker-credentials.sh
+++ b/ci/scripts/generate-docker-credentials.sh
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+set -eu
+
+export TERM="xterm-256color"
+
+readonly DOCKER_CONFIG_OUTPUT="${DOCKER_CONFIG_OUTPUT:?must be set}"
+
+printf "%s" "$REGISTRY_PASSWORD" | docker login "$REGISTRY" --username "$REGISTRY_USERNAME" --password-stdin
+cp -v ~/.docker/config.json "$DOCKER_CONFIG_OUTPUT/"
--- a/ci/tasks/build-oci-image.yml
+++ b/ci/tasks/build-oci-image.yml
@@ -0,0 +1,25 @@
+---
+platform: linux
+
+image_resource:
+  type: registry-image
+  source:
+    repository: ((spring-credhub-virtual-docker-registry))/concourse/oci-build-task
+    tag: 0.11.1
+    username: ((broadcom-jfrog-artifactory-robot-account.username))
+    password: ((broadcom-jfrog-artifactory-robot-account.password))
+
+inputs:
+  - name: git-repo
+  - name: docker-config
+
+outputs:
+  - name: image
+
+run:
+  path: build
+
+params:
+  CONTEXT:
+  DEBUG: true
+  DOCKER_CONFIG: docker-config
--- a/ci/tasks/build-project.yml
+++ b/ci/tasks/build-project.yml
@@ -3,9 +3,9 @@ platform: linux
 image_resource:
  type: registry-image
  source:
-    repository: ((corporate-harbor-registry))/((dockerhub-organization))/spring-credhub-ci
-    username: ((corporate-harbor-robot-account.username))
-    password: ((corporate-harbor-robot-account.password))
+    repository: ((spring-credhub-dev-docker-registry))/ci/spring-credhub-ci
+    username: ((broadcom-jfrog-artifactory-robot-account.username))
+    password: ((broadcom-jfrog-artifactory-robot-account.password))
    tag: ((ci-image-tag))
 inputs:
  - name: git-repo
@@ -19,3 +19,9 @@ run:
 params:
  ARTIFACTORY_USERNAME: ((artifactory-username))
  ARTIFACTORY_PASSWORD: ((artifactory-password))
+  DOCKERHUB_MIRROR_REGISTRY: ((spring-credhub-virtual-docker-registry))
+  DOCKERHUB_MIRROR_REGISTRY_USERNAME: ((broadcom-jfrog-artifactory-robot-account.username))
+  DOCKERHUB_MIRROR_REGISTRY_PASSWORD: ((broadcom-jfrog-artifactory-robot-account.password))
+  GRADLE_ENTERPRISE_CACHE_USERNAME: ((gradle-enterprise-cache-user))
+  GRADLE_ENTERPRISE_CACHE_PASSWORD: ((gradle-enterprise-cache-password))
+  GRADLE_ENTERPRISE_ACCESS_KEY: ((gradle-enterprise-secret-access-key))
--- a/ci/tasks/generate-docker-credentials.yml
+++ b/ci/tasks/generate-docker-credentials.yml
@@ -0,0 +1,25 @@
+platform: linux
+
+image_resource:
+  type: registry-image
+  source:
+    repository: ((spring-credhub-virtual-docker-registry))/docker
+    tag: 26-cli
+    username: ((broadcom-jfrog-artifactory-robot-account.username))
+    password: ((broadcom-jfrog-artifactory-robot-account.password))
+
+inputs:
+  - name: git-repo
+
+outputs:
+  - name: docker-config
+
+run:
+  path: ci/scripts/generate-docker-credentials.sh
+  dir: git-repo
+
+params:
+  DOCKER_CONFIG_OUTPUT: ../docker-config
+  REGISTRY: ((registry))
+  REGISTRY_USERNAME: ((registry-username))
+  REGISTRY_PASSWORD: ((registry-password))
--- a/ci/tasks/promote.yml
+++ b/ci/tasks/promote.yml
@@ -3,7 +3,9 @@ platform: linux
 image_resource:
  type: registry-image
  source:
-    repository: ((dockerhub-mirror-registry))/springio/concourse-release-scripts
+    repository: ((spring-credhub-virtual-docker-registry))/springio/concourse-release-scripts
+    username: ((broadcom-jfrog-artifactory-robot-account.username))
+    password: ((broadcom-jfrog-artifactory-robot-account.password))
    tag: '0.3.4'
 inputs:
  - name: git-repo
--- a/ci/tasks/stage.yml
+++ b/ci/tasks/stage.yml
@@ -3,9 +3,9 @@ platform: linux
 image_resource:
  type: registry-image
  source:
-    repository: ((corporate-harbor-registry))/((dockerhub-organization))/spring-credhub-ci
-    username: ((corporate-harbor-robot-account.username))
-    password: ((corporate-harbor-robot-account.password))
+    repository: ((spring-credhub-dev-docker-registry))/ci/spring-credhub-ci
+    username: ((broadcom-jfrog-artifactory-robot-account.username))
+    password: ((broadcom-jfrog-artifactory-robot-account.password))
    tag: ((ci-image-tag))
 inputs:
  - name: git-repo
--- a/ci/tasks/sync-to-maven-central.yml
+++ b/ci/tasks/sync-to-maven-central.yml
@@ -3,7 +3,9 @@ platform: linux
 image_resource:
  type: registry-image
  source:
-    repository: ((dockerhub-mirror-registry))/springio/concourse-release-scripts
+    repository: ((spring-credhub-virtual-docker-registry))/springio/concourse-release-scripts
+    username: ((broadcom-jfrog-artifactory-robot-account.username))
+    password: ((broadcom-jfrog-artifactory-robot-account.password))
    tag: '0.3.4'
 inputs:
  - name: git-repo