Mukul Sharma
51d3a0a033
Build #5 got through checkout, loadConfig, and the pre_build hook, then hit two real bugs at the actual docker build step: 1. `docker build` failed with "mkdir /root/.docker/buildx: read-only file system" — dind-pod.yaml mounts the Harbor push-auth secret read-only at /root/.docker, but modern docker defaults to BuildKit/buildx, which wants to write its own state there. Forces the classic builder via DOCKER_BUILDKIT=0 instead. 2. The subsequent error-handling itself then threw a NullPointerException — every stage file (including untouched legacy ones from the real devops-lib) reads env.FAILURE when setting currentBuild.result, but nothing in this repo ever defined it, so it was null. Defined once in homelabPipeline.groovy rather than touching 40+ individual occurrences across every stage file.
65 lines
2.6 KiB
YAML
65 lines
2.6 KiB
YAML
# New resource — didn't exist in the original devops-lib. Homelab's real
|
|
# pipelines built on static agents (node('slave02')) with Docker already
|
|
# available; this homelab's Jenkins uses dynamic per-build Kubernetes
|
|
# agents (agent.enabled in the jenkins chart), which don't have a Docker
|
|
# daemon by default. This pod template adds one as a sidecar container —
|
|
# the "docker" container runs privileged dind, "docker-cli" is what the
|
|
# pipeline actually execs into via container('docker-cli'), talking to
|
|
# its sibling over localhost since containers in one pod share a network
|
|
# namespace.
|
|
apiVersion: v1
|
|
kind: Pod
|
|
spec:
|
|
containers:
|
|
- name: docker
|
|
image: docker:27-dind
|
|
securityContext:
|
|
privileged: true
|
|
env:
|
|
- name: DOCKER_TLS_CERTDIR
|
|
value: ""
|
|
volumeMounts:
|
|
- name: docker-graph-storage
|
|
mountPath: /var/lib/docker
|
|
- name: docker-cli
|
|
image: docker:27-cli
|
|
command: ["cat"]
|
|
tty: true
|
|
env:
|
|
- name: DOCKER_HOST
|
|
value: tcp://localhost:2375
|
|
# docker-config below mounts the Harbor push-auth secret
|
|
# read-only at /root/.docker (needed so `docker push` finds
|
|
# config.json without an explicit `docker login` step) — but
|
|
# modern `docker build` defaults to BuildKit/buildx, which wants
|
|
# to create its own state dir at /root/.docker/buildx and fails
|
|
# with "read-only file system" since the whole mount is
|
|
# read-only. Forcing the classic builder avoids needing to write
|
|
# there at all.
|
|
- name: DOCKER_BUILDKIT
|
|
value: "0"
|
|
# For syncArgoApp.groovy — read directly from the ESO-managed
|
|
# Secret, not a Jenkins-native credential (nothing in this
|
|
# pipeline uses Jenkins' own credential store; staying consistent
|
|
# rather than mixing the two approaches).
|
|
- name: ARGOCD_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: argocd-jenkins-ci-token
|
|
key: token
|
|
# Without this, every build using this pod template hard-fails
|
|
# to even start until the token secret exists — including the
|
|
# very first demo-go-app run, before the manual
|
|
# `argocd account generate-token` bootstrap step has happened.
|
|
optional: true
|
|
volumeMounts:
|
|
- name: docker-config
|
|
mountPath: /root/.docker
|
|
readOnly: true
|
|
volumes:
|
|
- name: docker-graph-storage
|
|
emptyDir: {}
|
|
- name: docker-config
|
|
secret:
|
|
secretName: harbor-robot-dockerconfig
|