Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(ci): login to docker #2277

Merged
merged 13 commits into from
Nov 25, 2024
Merged

chore(ci): login to docker #2277

Show file tree
Hide file tree
Changes from 12 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
c852139
login to docker
lerouxb Nov 22, 2024
9a5a916
incorrect env var..
lerouxb Nov 22, 2024
0a7a842
typo
lerouxb Nov 22, 2024
c16a1b0
the folder, not the file
lerouxb Nov 22, 2024
a8b40a0
missed some
lerouxb Nov 22, 2024
9b20358
remember to update evergreen
lerouxb Nov 22, 2024
3ace817
switch to using a credential helper rather than a credential store
lerouxb Nov 24, 2024
b96be95
no idea what to use as the default
lerouxb Nov 24, 2024
128d1a5
Revert "no idea what to use as the default"
lerouxb Nov 24, 2024
ad052e8
Revert "switch to using a credential helper rather than a credential …
lerouxb Nov 24, 2024
6c0fb2e
just remove the env var
lerouxb Nov 24, 2024
19ab06d
Merge branch 'main' into login-docker-hub
lerouxb Nov 25, 2024
aaa77b0
bash syntax
lerouxb Nov 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions .evergreen.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6907,6 +6907,8 @@ functions:
shell: bash
env:
NODE_JS_VERSION: ${node_js_version}
DOCKERHUB_USERNAME: ${dockerhub_username}
DOCKERHUB_PASSWORD: ${dockerhub_password}
script: |
set -e
{
Expand All @@ -6930,6 +6932,8 @@ functions:
NODE_JS_VERSION: ${node_js_version}
TEST_MONGOSH_EXECUTABLE: ${test_mongosh_executable|}
KERBEROS_JUMPHOST_DOCKERFILE: ${kerberos_jumphost_dockerfile|}
DOCKERHUB_USERNAME: ${dockerhub_username}
DOCKERHUB_PASSWORD: ${dockerhub_password}
script: |
set -e
{
Expand Down Expand Up @@ -7223,6 +7227,8 @@ functions:
DISTRO_ID_OVERRIDE: ${distro_id}
PACKAGE_VARIANT: ${package_variant}
ARTIFACT_URL_EXTRA_TAG: unsigned
DOCKERHUB_USERNAME: ${dockerhub_username}
DOCKERHUB_PASSWORD: ${dockerhub_password}
sign_artifact:
- command: expansions.write
type: setup
Expand Down Expand Up @@ -7329,6 +7335,8 @@ functions:
shell: bash
env:
NODE_JS_VERSION: ${node_js_version}
DOCKERHUB_USERNAME: ${dockerhub_username}
DOCKERHUB_PASSWORD: ${dockerhub_password}
script: |
set -e
set -x
Expand All @@ -7343,6 +7351,8 @@ functions:
shell: bash
env:
NODE_JS_VERSION: ${node_js_version}
DOCKERHUB_USERNAME: ${dockerhub_username}
DOCKERHUB_PASSWORD: ${dockerhub_password}
script: |
set -e
set -x
Expand Down
32 changes: 32 additions & 0 deletions .evergreen/docker-config/bin/docker-credential-from-env
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
#!/bin/bash

set -euo pipefail

DOCKER_HUB_URL="https://index.docker.io/v1/"

STDIN=$(cat)

ACTION="$1"

case "$ACTION" in
get)
SERVER_URL="$STDIN"

if [[ "$SERVER_URL" == "$DOCKER_HUB_URL" ]]; then
if [[ -z "${DOCKERHUB_USERNAME:-}" || -z "${DOCKERHUB_PASSWORD:-}" ]]; then
echo "Error: DOCKERHUB_USERNAME or DOCKERHUB_PASSWORD environment variables are not set." >&2
exit 1
fi

echo "{\"Username\": \"$DOCKERHUB_USERNAME\", \"Secret\": \"$DOCKERHUB_PASSWORD\"}"
else
echo "Error: No credentials available for $SERVER_URL" >&2
exit 1
fi
;;

*)
echo "Unsupported action: $ACTION" >&2
exit 1
;;
esac
6 changes: 6 additions & 0 deletions .evergreen/docker-config/config.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
{
"auths": {
"https://index.docker.io/v1/": {}
},
"credsStore": "from-env"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A problem is that by specifying credsStore, the docker-credential-from-env script gets used for all stores. And at that point I can't tell if there's a way for the script to signal that a specific registry should be used without authentication.

What then happens is that we don't have credentials for registry.suse.com and then our script errors.

There is an alternative to credsStore which is credHelpers where you can specify a credential helper per registry domain. I tried it, but no matter what I used as the registry domain for docker hub I couldn't get it to use our script, so everything just worked unauthenticated. I looked online and can't find any examples where people specify the default docker hub registry domain in there so I'm beginning to think that it doesn't work for that case.

Unless I misread the docs or had some silly typo throughout all my tests? Not sure.

So what I'm doing now is to just specify credsStore which at least works in that it executes our script and then I just remove the DOCKER_CONFIG var for the suse cases. Which is an ugly hack and will probably stop working if we mix suse and regular docker images together in one script.

}
10 changes: 10 additions & 0 deletions .evergreen/evergreen.yml.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -383,6 +383,8 @@ functions:
shell: bash
env:
NODE_JS_VERSION: ${node_js_version}
DOCKERHUB_USERNAME: ${dockerhub_username}
DOCKERHUB_PASSWORD: ${dockerhub_password}
script: |
set -e
{
Expand All @@ -406,6 +408,8 @@ functions:
NODE_JS_VERSION: ${node_js_version}
TEST_MONGOSH_EXECUTABLE: ${test_mongosh_executable|}
KERBEROS_JUMPHOST_DOCKERFILE: ${kerberos_jumphost_dockerfile|}
DOCKERHUB_USERNAME: ${dockerhub_username}
DOCKERHUB_PASSWORD: ${dockerhub_password}
script: |
set -e
{
Expand Down Expand Up @@ -635,6 +639,8 @@ functions:
DISTRO_ID_OVERRIDE: ${distro_id}
PACKAGE_VARIANT: ${package_variant}
ARTIFACT_URL_EXTRA_TAG: unsigned
DOCKERHUB_USERNAME: ${dockerhub_username}
DOCKERHUB_PASSWORD: ${dockerhub_password}
sign_artifact:
- command: expansions.write
type: setup
Expand Down Expand Up @@ -741,6 +747,8 @@ functions:
shell: bash
env:
NODE_JS_VERSION: ${node_js_version}
DOCKERHUB_USERNAME: ${dockerhub_username}
DOCKERHUB_PASSWORD: ${dockerhub_password}
script: |
set -e
set -x
Expand All @@ -755,6 +763,8 @@ functions:
shell: bash
env:
NODE_JS_VERSION: ${node_js_version}
DOCKERHUB_USERNAME: ${dockerhub_username}
DOCKERHUB_PASSWORD: ${dockerhub_password}
script: |
set -e
set -x
Expand Down
3 changes: 3 additions & 0 deletions .evergreen/setup-env.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,9 @@ if [ "$OS" == "Windows_NT" ]; then
export npm_config_logs_dir="$(cygpath -w "$npm_config_logs_dir")"
fi

export DOCKER_CONFIG="$BASEDIR/docker-config"
export PATH="$BASEDIR/docker-config/bin:$PATH"

echo "Running on:"
uname -a

Expand Down
5 changes: 5 additions & 0 deletions scripts/docker/build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@ cd "$(dirname "$0")"
# Used for verifying that we actually have a working csfle shared library
[ -x node_modules/mongodb-crypt-library-version ] || ((cd ../.. && npm ci) && cp -r ../../node_modules node_modules)

# we don't have credentials for registry.suse.com and docker now requires them due to our config
if [[ "$1" == suse* ]]
unset DOCKER_CONFIG
fi

if [ x"$ARTIFACT_URL" = x"" ]; then
SHA=`git rev-parse origin/main`
VERSION=`git show ${SHA}:../../lerna.json | grep version | cut -d ":" -f 2 | cut -d '"' -f 2`
Expand Down
Loading