Mukul Sharma
3b48d51b18
Replaces per-build on-demand installs (apk add bash/python3/curl,
curl-downloading yq to /tmp) in runHooks.groovy, syncArgoApp.groovy,
and updateHelmTag.groovy with a single custom image
(build-tools.Dockerfile) that has all of it baked in once, at
image-build time — not repeated on every single pipeline run.
updateHelmTag.groovy also now runs inside container('docker-cli')
(previously unwrapped, defaulting to the auto-injected jnlp agent
container, which is why it needed the curl-downloaded yq fallback in
the first place — that container has git but not yq).
dind-pod.yaml's docker-cli container now points at
harbor.192.168.1.7.nip.io/homelab/build-tools:1 instead of the stock
docker:27-cli — this image needs building and pushing once before any
build using this pod template will work; see build-tools.Dockerfile's
header comment.
98 lines
4.6 KiB
YAML
98 lines
4.6 KiB
YAML
# New resource — didn't exist in the original devops-lib. Homelab's real
|
|
# pipelines built on static agents (node('slave02')) with Docker already
|
|
# available; this homelab's Jenkins uses dynamic per-build Kubernetes
|
|
# agents (agent.enabled in the jenkins chart), which don't have a Docker
|
|
# daemon by default. This pod template adds one as a sidecar container —
|
|
# the "docker" container runs privileged dind, "docker-cli" is what the
|
|
# pipeline actually execs into via container('docker-cli'), talking to
|
|
# its sibling over localhost since containers in one pod share a network
|
|
# namespace.
|
|
apiVersion: v1
|
|
kind: Pod
|
|
spec:
|
|
containers:
|
|
- name: docker
|
|
image: docker:27-dind
|
|
securityContext:
|
|
privileged: true
|
|
# Harbor's ingress serves plain HTTP too (TLS disabled cluster-wide
|
|
# by design — see claude.md's "everything is plain HTTP" note).
|
|
# Docker defaults to attempting HTTPS against any bare registry
|
|
# hostname regardless of network path, so this is needed
|
|
# regardless of which hostname is used — was previously
|
|
# harbor-core.harbor.svc.cluster.local (cluster-internal Service
|
|
# DNS, works from this pod but not from the node's own containerd
|
|
# when pulling for a real Deployment); switched to the Contour
|
|
# ingress hostname so push and pull can share one reference.
|
|
args:
|
|
- "--insecure-registry=harbor.192.168.1.7.nip.io"
|
|
env:
|
|
- name: DOCKER_TLS_CERTDIR
|
|
value: ""
|
|
volumeMounts:
|
|
- name: docker-graph-storage
|
|
mountPath: /var/lib/docker
|
|
- name: docker-cli
|
|
# Custom image (see build-tools.Dockerfile in this same directory)
|
|
# — bakes in git/yq/bash/python3+pip/venv/curl so nothing needs
|
|
# apk-installing or curl-downloading on every single build (was
|
|
# slow and, per its own point, defeats the purpose of a
|
|
# reproducible pipeline to be quietly downloading a tool binary
|
|
# fresh on every run). Versioned tag, not :latest — a rebuild of
|
|
# the tools image doesn't roll out until this pin is bumped too.
|
|
image: harbor.192.168.1.7.nip.io/homelab/build-tools:1
|
|
command: ["cat"]
|
|
tty: true
|
|
env:
|
|
- name: DOCKER_HOST
|
|
value: tcp://localhost:2375
|
|
# docker-config below mounts the Harbor push-auth secret
|
|
# read-only at /root/.docker (needed so `docker push` finds
|
|
# config.json without an explicit `docker login` step) — but
|
|
# modern `docker build` defaults to BuildKit/buildx, which wants
|
|
# to create its own state dir at /root/.docker/buildx and fails
|
|
# with "read-only file system" since the whole mount is
|
|
# read-only. Forcing the classic builder avoids needing to write
|
|
# there at all.
|
|
- name: DOCKER_BUILDKIT
|
|
value: "0"
|
|
# For syncArgoApp.groovy — read directly from the ESO-managed
|
|
# Secret, not a Jenkins-native credential (nothing in this
|
|
# pipeline uses Jenkins' own credential store; staying consistent
|
|
# rather than mixing the two approaches).
|
|
- name: ARGOCD_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: argocd-jenkins-ci-token
|
|
key: token
|
|
# Without this, every build using this pod template hard-fails
|
|
# to even start until the token secret exists — including the
|
|
# very first demo-go-app run, before the manual
|
|
# `argocd account generate-token` bootstrap step has happened.
|
|
optional: true
|
|
volumeMounts:
|
|
- name: docker-config
|
|
mountPath: /root/.docker
|
|
readOnly: true
|
|
volumes:
|
|
- name: docker-graph-storage
|
|
emptyDir: {}
|
|
- name: docker-config
|
|
secret:
|
|
secretName: harbor-robot-dockerconfig
|
|
# kubernetes.io/dockerconfigjson secrets store their data under
|
|
# the fixed key `.dockerconfigjson` (mandated, since that's what
|
|
# kubelet reads for imagePullSecrets) — without this remap, the
|
|
# mounted file at /root/.docker is literally named
|
|
# `.dockerconfigjson`, not `config.json`, which is the only
|
|
# filename the docker CLI itself ever reads for stored
|
|
# credentials. Docker found nothing there and silently pushed
|
|
# unauthenticated, which Harbor correctly rejected as
|
|
# unauthorized — confirmed the robot account/credentials
|
|
# themselves were fine the whole time by requesting a push token
|
|
# directly from Harbor's token endpoint with the same username/
|
|
# password and getting one back with push access granted.
|
|
items:
|
|
- key: .dockerconfigjson
|
|
path: config.json
|