You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Konflux-build-cli: replace build step of build-image-index task
Start using the konflux-build-cli for building the image index.
Related PR: konflux-ci/konflux-build-cli#69
Also NOTE: The build step is now run explicitly as root by using
runAsUser: 0, since the permissions for the "konflux-build-cli" container
are different and they no longer allow executing the necessary setup steps,
like updating the ca-trust. The step was always run with root
permissions, now it us just explicitly setup in the tekton step.
STONEBLD-4060
Assisted-by: Claude
Signed-off-by: mkosiarc <mkosiarc@redhat.com>
Copy file name to clipboardExpand all lines: pipelines/docker-build-multi-platform-oci-ta/README.md
+8-10Lines changed: 8 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,16 +9,16 @@ This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/reposito
9
9
|---|---|---|---|
10
10
|build-args| Array of --build-arg values ("arg=value" strings) for buildah|[]| build-images:0.9:BUILD_ARGS ; sast-coverity-check:0.3:BUILD_ARGS|
11
11
|build-args-file| Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file|| build-images:0.9:BUILD_ARGS_FILE ; sast-coverity-check:0.3:BUILD_ARGS_FILE|
12
-
|build-image-index| Add built image into an OCI image index| true| build-image-index:0.2:ALWAYS_BUILD_INDEX|
12
+
|build-image-index| Add built image into an OCI image index| true| build-image-index:0.3:ALWAYS_BUILD_INDEX|
13
13
|build-platforms| List of platforms to build the container images on. The available set of values is determined by the configuration of the multi-platform-controller.|['linux/x86_64']||
14
14
|build-source-image| Build a source image.| false||
15
-
|buildah-format| The format for the resulting image's mediaType. Valid values are oci or docker.| docker| build-images:0.9:BUILDAH_FORMAT ; build-image-index:0.2:BUILDAH_FORMAT|
15
+
|buildah-format| The format for the resulting image's mediaType. Valid values are oci or docker.| docker| build-images:0.9:BUILDAH_FORMAT ; build-image-index:0.3:BUILDAH_FORMAT|
16
16
|dockerfile| Path to the Dockerfile inside the context specified by parameter path-context| Dockerfile| build-images:0.9:DOCKERFILE ; sast-coverity-check:0.3:DOCKERFILE ; push-dockerfile:0.3:DOCKERFILE|
|hermetic| Execute the build with network isolation| false| build-images:0.9:HERMETIC ; sast-coverity-check:0.3:HERMETIC|
20
-
|image-expires-after| Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.|| clone-repository:0.1:ociArtifactExpiresAfter ; prefetch-dependencies:0.3:ociArtifactExpiresAfter ; build-images:0.9:IMAGE_EXPIRES_AFTER ; build-image-index:0.2:IMAGE_EXPIRES_AFTER ; sast-coverity-check:0.3:IMAGE_EXPIRES_AFTER|
|image-expires-after| Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.|| clone-repository:0.1:ociArtifactExpiresAfter ; prefetch-dependencies:0.3:ociArtifactExpiresAfter ; build-images:0.9:IMAGE_EXPIRES_AFTER ; sast-coverity-check:0.3:IMAGE_EXPIRES_AFTER|
|path-context| Path to the source code of an application's component from where to build image.| .| build-images:0.9:CONTEXT ; sast-coverity-check:0.3:CONTEXT ; push-dockerfile:0.3:CONTEXT|
23
23
|prefetch-input| Build dependencies to be prefetched|| prefetch-dependencies:0.3:input ; build-images:0.9:PREFETCH_INPUT ; sast-coverity-check:0.3:PREFETCH_INPUT|
24
24
|privileged-nested| Whether to enable privileged mode, should be used only with remote VMs| false| build-images:0.9:PRIVILEGED_NESTED|
@@ -35,15 +35,13 @@ This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/reposito
35
35
|IMAGE_DIGEST| Image digest of the built image.| None| '$(tasks.build-image-index.results.IMAGE_DIGEST)'|
36
36
|IMAGE_URL| Image repository and tag reference of the the built image.| None| '$(tasks.build-image-index.results.IMAGE_URL)'|
37
37
|LOG_LEVEL| Log level to use in the task. See golang logrus docs for available levels.| info||
38
-
### build-image-index:0.2 task parameters
38
+
### build-image-index:0.3 task parameters
39
39
|name|description|default value|already set by|
40
40
|---|---|---|---|
41
41
|ALWAYS_BUILD_INDEX| Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.| true| '$(params.build-image-index)'|
42
42
|BUILDAH_FORMAT| The format for the resulting image's mediaType. Valid values are oci (default) or docker.| oci| '$(params.buildah-format)'|
43
-
|COMMIT_SHA| The commit the image is built from.| ""| '$(tasks.clone-repository.results.commit)'|
44
43
|IMAGE| The target image and tag where the image will be pushed to.| None| '$(params.output-image)'|
45
44
|IMAGES| List of Image Manifests to be referenced by the Image Index| None| '['$(tasks.build-images.results.IMAGE_REF[*])']'|
46
-
|IMAGE_EXPIRES_AFTER| Delete image tag after specified time resulting in garbage collection of the digest. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.| ""| '$(params.image-expires-after)'|
47
45
|SBOM_SKIP_VALIDATION| Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.| false||
48
46
|STORAGE_DRIVER| Storage driver to configure for buildah| vfs||
49
47
|TLSVERIFY| Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)| true||
@@ -329,7 +327,7 @@ This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/reposito
|name|description|used in params (taskname:taskrefversion:taskparam)
334
332
|---|---|---|
335
333
|IMAGES| List of all referenced image manifests||
@@ -341,7 +339,7 @@ This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/reposito
341
339
|name|description|used in params (taskname:taskrefversion:taskparam)
342
340
|---|---|---|
343
341
|IMAGE_DIGEST| Digest of the image just built||
344
-
|IMAGE_REF| Image reference of the built image| build-image-index:0.2:IMAGES|
342
+
|IMAGE_REF| Image reference of the built image| build-image-index:0.3:IMAGES|
345
343
|IMAGE_URL| Image repository and tag where the built image was pushed||
346
344
|SBOM_BLOB_URL| Reference of SBOM blob digest to enable digest-based verification from provenance||
347
345
### clair-scan:0.3 task results
@@ -379,7 +377,7 @@ This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/reposito
379
377
|CHAINS-GIT_COMMIT| The precise commit SHA that was fetched by this Task. This result uses Chains type hinting to include in the provenance.||
380
378
|CHAINS-GIT_URL| The precise URL that was fetched by this Task. This result uses Chains type hinting to include in the provenance.||
381
379
|SOURCE_ARTIFACT| The Trusted Artifact URI pointing to the artifact with the application source code.| prefetch-dependencies:0.3:SOURCE_ARTIFACT|
382
-
|commit| The precise commit SHA that was fetched by this Task.| build-images:0.9:COMMIT_SHA ; build-image-index:0.2:COMMIT_SHA ; sast-coverity-check:0.3:COMMIT_SHA|
380
+
|commit| The precise commit SHA that was fetched by this Task.| build-images:0.9:COMMIT_SHA ; sast-coverity-check:0.3:COMMIT_SHA|
383
381
|commit-timestamp| The commit timestamp of the checkout||
384
382
|merged_sha| The SHA of the commit after merging the target branch (if the param mergeTargetBranch is true).||
385
383
|short-commit| The commit SHA that was fetched by this Task limited to params.shortCommitLength number of characters||
Copy file name to clipboardExpand all lines: pipelines/docker-build-oci-ta-min/README.md
+8-10Lines changed: 8 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,30 +11,28 @@ This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/reposito
11
11
|---|---|---|---|
12
12
|build-args| Array of --build-arg values ("arg=value" strings) for buildah|[]| build-container:0.9:BUILD_ARGS|
13
13
|build-args-file| Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file|| build-container:0.9:BUILD_ARGS_FILE|
14
-
|build-image-index| Add built image into an OCI image index| false| build-image-index:0.2:ALWAYS_BUILD_INDEX|
15
-
|buildah-format| The format for the resulting image's mediaType. Valid values are oci or docker.| docker| build-container:0.9:BUILDAH_FORMAT ; build-image-index:0.2:BUILDAH_FORMAT|
14
+
|build-image-index| Add built image into an OCI image index| false| build-image-index:0.3:ALWAYS_BUILD_INDEX|
15
+
|buildah-format| The format for the resulting image's mediaType. Valid values are oci or docker.| docker| build-container:0.9:BUILDAH_FORMAT ; build-image-index:0.3:BUILDAH_FORMAT|
16
16
|dockerfile| Path to the Dockerfile inside the context specified by parameter path-context| Dockerfile| build-container:0.9:DOCKERFILE|
|hermetic| Execute the build with network isolation| false| build-container:0.9:HERMETIC|
20
-
|image-expires-after| Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.|| clone-repository:0.1:ociArtifactExpiresAfter ; prefetch-dependencies:0.3:ociArtifactExpiresAfter ; build-container:0.9:IMAGE_EXPIRES_AFTER ; build-image-index:0.2:IMAGE_EXPIRES_AFTER|
|image-expires-after| Image tag expiration time, time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.|| clone-repository:0.1:ociArtifactExpiresAfter ; prefetch-dependencies:0.3:ociArtifactExpiresAfter ; build-container:0.9:IMAGE_EXPIRES_AFTER|
|path-context| Path to the source code of an application's component from where to build image.| .| build-container:0.9:CONTEXT|
23
23
|prefetch-input| Build dependencies to be prefetched|| prefetch-dependencies:0.3:input ; build-container:0.9:PREFETCH_INPUT|
24
24
|privileged-nested| Whether to enable privileged mode, should be used only with remote VMs| false| build-container:0.9:PRIVILEGED_NESTED|
25
25
|revision| Revision of the Source Repository|| clone-repository:0.1:revision|
26
26
|skip-checks| Skip checks against built image| false||
27
27
28
28
## Available params from tasks
29
-
### build-image-index-min:0.2 task parameters
29
+
### build-image-index-min:0.3 task parameters
30
30
|name|description|default value|already set by|
31
31
|---|---|---|---|
32
32
|ALWAYS_BUILD_INDEX| Build an image index even if IMAGES is of length 1. Default true. If the image index generation is skipped, the task will forward values for params.IMAGES[0] to results.IMAGE_*. In order to properly set all results, use the repository:tag@sha256:digest format for the IMAGES parameter.| true| '$(params.build-image-index)'|
33
33
|BUILDAH_FORMAT| The format for the resulting image's mediaType. Valid values are oci (default) or docker.| oci| '$(params.buildah-format)'|
34
-
|COMMIT_SHA| The commit the image is built from.| ""| '$(tasks.clone-repository.results.commit)'|
35
34
|IMAGE| The target image and tag where the image will be pushed to.| None| '$(params.output-image)'|
36
35
|IMAGES| List of Image Manifests to be referenced by the Image Index| None| '['$(tasks.build-container.results.IMAGE_URL)@$(tasks.build-container.results.IMAGE_DIGEST)']'|
37
-
|IMAGE_EXPIRES_AFTER| Delete image tag after specified time resulting in garbage collection of the digest. Empty means to keep the image tag. Time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively.| ""| '$(params.image-expires-after)'|
38
36
|SBOM_SKIP_VALIDATION| Flag to enable or disable SBOM validation before save. Validation is optional - use this if you are experiencing performance issues.| false||
39
37
|STORAGE_DRIVER| Storage driver to configure for buildah| vfs||
40
38
|TLSVERIFY| Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry)| true||
@@ -224,7 +222,7 @@ This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/reposito
0 commit comments