Skip to content
Snippets Groups Projects
Commit b117102f authored by Pierre Smeyers's avatar Pierre Smeyers
Browse files

docs(readme): markdown formatting and fixes

parent 9b0e8b42
Branches
Tags
No related merge requests found
Show whitespace changes
Inline Side-by-side
Showing
with 229 additions and 230 deletions
README.md
+ 229
− 230
View file @ b117102f
...@@ -57,7 +57,7 @@ select an alternate build tool by using the `DOCKER_BUILD_TOOL` variable (see be ...@@ -57,7 +57,7 @@ select an alternate build tool by using the `DOCKER_BUILD_TOOL` variable (see be
The Docker template uses some global configuration used throughout all jobs. The Docker template uses some global configuration used throughout all jobs.
| Input / Variable | Description | Default value | | Input / Variable | Description | Default value |
| --------------------- | -------------------------------------- | ----------------- | | ---------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
| `build-tool` / `DOCKER_BUILD_TOOL` | The build tool to use for building container image, possible values are `kaniko`, `buildah` or `dind` | `kaniko` | | `build-tool` / `DOCKER_BUILD_TOOL` | The build tool to use for building container image, possible values are `kaniko`, `buildah` or `dind` | `kaniko` |
| `kaniko-image` / `DOCKER_KANIKO_IMAGE` | The image used to run `kaniko` - _for kaniko build only_ | `gcr.io/kaniko-project/executor:debug` (use `debug` images for GitLab) | | `kaniko-image` / `DOCKER_KANIKO_IMAGE` | The image used to run `kaniko` - _for kaniko build only_ | `gcr.io/kaniko-project/executor:debug` (use `debug` images for GitLab) |
| `buildah-image` / `DOCKER_BUILDAH_IMAGE` | The image used to run `buildah` - _for buildah build only_ | `quay.io/buildah/stable` | | `buildah-image` / `DOCKER_BUILDAH_IMAGE` | The image used to run `buildah` - _for buildah build only_ | `quay.io/buildah/stable` |
...@@ -69,12 +69,11 @@ The Docker template uses some global configuration used throughout all jobs. ...@@ -69,12 +69,11 @@ The Docker template uses some global configuration used throughout all jobs.
In addition to this, the template supports _standard_ Linux proxy variables: In addition to this, the template supports _standard_ Linux proxy variables:
| Input / Variable | Description | Default value | | Input / Variable | Description | Default value |
| --------------------- | ------------------------------------------- | ------------- | | ---------------- | ------------------------------------------- | ------------- |
| `http_proxy` | Proxy used for http requests | _none_ | | `http_proxy` | Proxy used for http requests | _none_ |
| `https_proxy` | Proxy used for https requests | _none_ | | `https_proxy` | Proxy used for https requests | _none_ |
| `no_proxy` | List of comma-separated hosts/host suffixes | _none_ | | `no_proxy` | List of comma-separated hosts/host suffixes | _none_ |
### Images ### Images
For each Dockerfile, the template builds an image that may be [pushed](https://docs.docker.com/engine/reference/commandline/push/) For each Dockerfile, the template builds an image that may be [pushed](https://docs.docker.com/engine/reference/commandline/push/)
...@@ -88,23 +87,23 @@ as two distinct images, depending on a certain _workflow_: ...@@ -88,23 +87,23 @@ as two distinct images, depending on a certain _workflow_:
In practice: In practice:
* the **snapshot** image is **always pushed** by the template (pipeline triggered by a Git tag or commit on any branch), - the **snapshot** image is **always pushed** by the template (pipeline triggered by a Git tag or commit on any branch),
* the **release** image is only pushed: - the **release** image is only pushed:
* on a pipeline triggered by a Git tag, - on a pipeline triggered by a Git tag,
* on a pipeline triggered by a Git commit on `master`. - on a pipeline triggered by a Git commit on `master`.
The **snapshot** and **release** images are defined by the following variables: The **snapshot** and **release** images are defined by the following variables:
| Input / Variable | Description | Default value | | Input / Variable | Description | Default value |
| ------------------------- | --------------------- | ------------------------------------------------- | | ------------------------------------------ | --------------------- | ------------------------------------------------- |
| `snapshot-image` / `DOCKER_SNAPSHOT_IMAGE` | Docker snapshot image | `$CI_REGISTRY_IMAGE/snapshot:$CI_COMMIT_REF_SLUG` | | `snapshot-image` / `DOCKER_SNAPSHOT_IMAGE` | Docker snapshot image | `$CI_REGISTRY_IMAGE/snapshot:$CI_COMMIT_REF_SLUG` |
| `release-image` / `DOCKER_RELEASE_IMAGE` | Docker release image | `$CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME` | | `release-image` / `DOCKER_RELEASE_IMAGE` | Docker release image | `$CI_REGISTRY_IMAGE:$CI_COMMIT_REF_NAME` |
As you can see, the Docker template is configured by default to use the GitLab container registry. As you can see, the Docker template is configured by default to use the GitLab container registry.
You may perfectly override this and use another Docker registry, but be aware of a few things: You may perfectly override this and use another Docker registry, but be aware of a few things:
* the `DOCKER_SNAPSHOT_IMAGE` requires a Docker registry that allows tag overwrite, - the `DOCKER_SNAPSHOT_IMAGE` requires a Docker registry that allows tag overwrite,
* the `DOCKER_RELEASE_IMAGE` _may_ use a Docker registry that doesn't allow tag overwrite, but: - the `DOCKER_RELEASE_IMAGE` _may_ use a Docker registry that doesn't allow tag overwrite, but:
1. you should avoid overwriting a Git tag (at it will obviously fail while trying to (re)push the Docker image), 1. you should avoid overwriting a Git tag (at it will obviously fail while trying to (re)push the Docker image),
2. you have to deactivate publish on `main` (or `master`) branch by setting the `$DOCKER_PROD_PUBLISH_STRATEGY` variable to `none` (as it would lead to the `main` tag being overwritten). 2. you have to deactivate publish on `main` (or `master`) branch by setting the `$DOCKER_PROD_PUBLISH_STRATEGY` variable to `none` (as it would lead to the `main` tag being overwritten).
...@@ -122,7 +121,7 @@ If you use the **same registry** for both snapshot and release images, you shall ...@@ -122,7 +121,7 @@ If you use the **same registry** for both snapshot and release images, you shall
variables: variables:
| Input / Variable | Description | | Input / Variable | Description |
| -------------------------------- | -------------------------------------- | | --------------------------------- | ------------------------------------------- |
| :lock: `DOCKER_REGISTRY_USER` | Docker registry username for image registry | | :lock: `DOCKER_REGISTRY_USER` | Docker registry username for image registry |
| :lock: `DOCKER_REGISTRY_PASSWORD` | Docker registry password for image registry | | :lock: `DOCKER_REGISTRY_PASSWORD` | Docker registry password for image registry |
...@@ -131,7 +130,7 @@ variables: ...@@ -131,7 +130,7 @@ variables:
If you use **different registries** for snapshot and release images, you shall use separate configuration variables: If you use **different registries** for snapshot and release images, you shall use separate configuration variables:
| Input / Variable | Description | | Input / Variable | Description |
| ---------------------------------------- | -------------------------------------- | | ------------------------------------------ | ---------------------------------------------------- |
| :lock: `DOCKER_REGISTRY_SNAPSHOT_USER` | Docker registry username for snapshot image registry | | :lock: `DOCKER_REGISTRY_SNAPSHOT_USER` | Docker registry username for snapshot image registry |
| :lock: `DOCKER_REGISTRY_SNAPSHOT_PASSWORD` | Docker registry password for snapshot image registry | | :lock: `DOCKER_REGISTRY_SNAPSHOT_PASSWORD` | Docker registry password for snapshot image registry |
| :lock: `DOCKER_REGISTRY_RELEASE_USER` | Docker registry username for release image registry | | :lock: `DOCKER_REGISTRY_RELEASE_USER` | Docker registry username for release image registry |
...@@ -141,18 +140,18 @@ If you use **different registries** for snapshot and release images, you shall u ...@@ -141,18 +140,18 @@ If you use **different registries** for snapshot and release images, you shall u
There might be cases where you need to provide the complete [Docker configuration file](https://docs.docker.com/engine/reference/commandline/cli/#configuration-files): There might be cases where you need to provide the complete [Docker configuration file](https://docs.docker.com/engine/reference/commandline/cli/#configuration-files):
* need to declare authentication credentials for other registries than the 2 predefined ones (snapshot & release), - need to declare authentication credentials for other registries than the 2 predefined ones (snapshot & release),
* need to declare a [credentials store](https://docs.docker.com/engine/reference/commandline/login/#credentials-store) (ex: in order to [publish to Amazon ECR](https://github.com/GoogleContainerTools/kaniko#pushing-to-amazon-ecr) with Kaniko for instance), - need to declare a [credentials store](https://docs.docker.com/engine/reference/commandline/login/#credentials-store) (ex: in order to [publish to Amazon ECR](https://github.com/GoogleContainerTools/kaniko#pushing-to-amazon-ecr) with Kaniko for instance),
* need to declare [proxies](https://docs.docker.com/engine/reference/commandline/cli/#automatic-proxy-configuration-for-containers), - need to declare [proxies](https://docs.docker.com/engine/reference/commandline/cli/#automatic-proxy-configuration-for-containers),
* ... - ...
If you are in one of those cases, you will need to use the `DOCKER_CONFIG_FILE` variable, expected to declare the path to your custom Docker configuration file (JSON). You may: If you are in one of those cases, you will need to use the `DOCKER_CONFIG_FILE` variable, expected to declare the path to your custom Docker configuration file (JSON). You may:
* leave the default value (`.docker/config.json`) or override it to some alternate location in your project repository and create the file **without any secret in it** using our dynamic variables replacement (see below), - leave the default value (`.docker/config.json`) or override it to some alternate location in your project repository and create the file **without any secret in it** using our dynamic variables replacement (see below),
* or override it as a GitLab project variable of type [File](https://docs.gitlab.com/ee/ci/variables/#cicd-variable-types), possibly inlining your secret credentials in it. - or override it as a GitLab project variable of type [File](https://docs.gitlab.com/ee/ci/variables/#cicd-variable-types), possibly inlining your secret credentials in it.
| Input / Variable | Description | Default value | | Input / Variable | Description | Default value |
| ------------------------- | --------------------- | ------------------------------------------------- | | ------------------------------------ | -------------------------------------------- | --------------------- |
| `config-file` / `DOCKER_CONFIG_FILE` | Path to the Docker configuration file (JSON) | `.docker/config.json` | | `config-file` / `DOCKER_CONFIG_FILE` | Path to the Docker configuration file (JSON) | `.docker/config.json` |
Moreover, this file supports **dynamic environment variables replacement**. Moreover, this file supports **dynamic environment variables replacement**.
...@@ -160,10 +159,10 @@ That means it may contain references to other environment variables (in the form ...@@ -160,10 +159,10 @@ That means it may contain references to other environment variables (in the form
by the template before evaluation. by the template before evaluation.
In addition to you own defined variables, you may use the following variables (provided and managed by the template): In addition to you own defined variables, you may use the following variables (provided and managed by the template):
* `${docker_snapshot_authent_token}`: the authentication token required by the snapshot registry (computed from configured `DOCKER_REGISTRY_SNAPSHOT_USER` / `DOCKER_REGISTRY_SNAPSHOT_PASSWORD` variables) - `${docker_snapshot_authent_token}`: the authentication token required by the snapshot registry (computed from configured `DOCKER_REGISTRY_SNAPSHOT_USER` / `DOCKER_REGISTRY_SNAPSHOT_PASSWORD` variables)
* `${docker_snapshot_registry_host}`: the snapshot registry host (based on the configured `DOCKER_SNAPSHOT_IMAGE ` variable) - `${docker_snapshot_registry_host}`: the snapshot registry host (based on the configured `DOCKER_SNAPSHOT_IMAGE` variable)
* `${docker_release_authent_token}`: the authentication token required by the release registry (computed from configured `DOCKER_REGISTRY_RELEASE_USER` / `DOCKER_REGISTRY_RELEASE_PASSWORD` variables) - `${docker_release_authent_token}`: the authentication token required by the release registry (computed from configured `DOCKER_REGISTRY_RELEASE_USER` / `DOCKER_REGISTRY_RELEASE_PASSWORD` variables)
* `${docker_release_registry_host}`: the release registry host (based on the configured `DOCKER_RELEASE_IMAGE ` variable) - `${docker_release_registry_host}`: the release registry host (based on the configured `DOCKER_RELEASE_IMAGE` variable)
Example 1: Docker configuration file inlined in the project repository (`.docker/config.json`) with **dynamic variables replacement**: Example 1: Docker configuration file inlined in the project repository (`.docker/config.json`) with **dynamic variables replacement**:
...@@ -185,12 +184,11 @@ Example 1: Docker configuration file inlined in the project repository (`.docker ...@@ -185,12 +184,11 @@ Example 1: Docker configuration file inlined in the project repository (`.docker
This file uses: This file uses:
* template-managed `${docker_snapshot_authent_token}`, `${docker_snapshot_registry_host}`, `${docker_release_authent_token}` and `${docker_release_registry_host}` variables, - template-managed `${docker_snapshot_authent_token}`, `${docker_snapshot_registry_host}`, `${docker_release_authent_token}` and `${docker_release_registry_host}` variables,
* the user-defined `${MY_OWN_REGISTRY_TOKEN}` (:information_source: an authentication token can be obtained with command `echo "user:password" | base64` and then be stored as a masked GitLab CI/CD project variable). - the user-defined `${MY_OWN_REGISTRY_TOKEN}` (:information_source: an authentication token can be obtained with command `echo "user:password" | base64` and then be stored as a masked GitLab CI/CD project variable).
Example 2: Docker configuration file declared as a GitLab project variable of type [File](https://docs.gitlab.com/ee/ci/variables/#cicd-variable-types) with **dynamic variables replacement**: Example 2: Docker configuration file declared as a GitLab project variable of type [File](https://docs.gitlab.com/ee/ci/variables/#cicd-variable-types) with **dynamic variables replacement**:
```json ```json
{ {
"auths": { "auths": {
...@@ -209,8 +207,8 @@ Example 2: Docker configuration file declared as a GitLab project variable of ty ...@@ -209,8 +207,8 @@ Example 2: Docker configuration file declared as a GitLab project variable of ty
This file uses: This file uses:
* template-managed `${docker_snapshot_authent_token}`, `${docker_snapshot_registry_host}`, `${docker_release_authent_token}` and `${docker_release_registry_host}` variables (:warning: mind the double `$$` to prevent GitLab from [trying to evaluate the variable](https://docs.gitlab.com/ee/ci/variables/index.html#use-the--character-in-variables)), - template-managed `${docker_snapshot_authent_token}`, `${docker_snapshot_registry_host}`, `${docker_release_authent_token}` and `${docker_release_registry_host}` variables (:warning: mind the double `$$` to prevent GitLab from [trying to evaluate the variable](https://docs.gitlab.com/ee/ci/variables/index.html#use-the--character-in-variables)),
* the user-defined authentication may be inlined as a GitLab project variable is a place safe enough to store secrets. - the user-defined authentication may be inlined as a GitLab project variable is a place safe enough to store secrets.
## Multi Dockerfile support ## Multi Dockerfile support
...@@ -251,9 +249,9 @@ variables: ...@@ -251,9 +249,9 @@ variables:
Here are some advices about your **secrets** (variables marked with a :lock:): Here are some advices about your **secrets** (variables marked with a :lock:):
1. Manage them as [project or group CI/CD variables](https://docs.gitlab.com/ee/ci/variables/#for-a-project): 1. Manage them as [project or group CI/CD variables](https://docs.gitlab.com/ee/ci/variables/#for-a-project):
* [**masked**](https://docs.gitlab.com/ee/ci/variables/#mask-a-cicd-variable) to prevent them from being inadvertently - [**masked**](https://docs.gitlab.com/ee/ci/variables/#mask-a-cicd-variable) to prevent them from being inadvertently
displayed in your job logs, displayed in your job logs,
* [**protected**](https://docs.gitlab.com/ee/ci/variables/#protected-cicd-variables) if you want to secure some secrets - [**protected**](https://docs.gitlab.com/ee/ci/variables/#protected-cicd-variables) if you want to secure some secrets
you don't want everyone in the project to have access to (for instance production secrets). you don't want everyone in the project to have access to (for instance production secrets).
2. In case a secret contains [characters that prevent it from being masked](https://docs.gitlab.com/ee/ci/variables/#mask-a-cicd-variable), 2. In case a secret contains [characters that prevent it from being masked](https://docs.gitlab.com/ee/ci/variables/#mask-a-cicd-variable),
simply define its value as the [Base64](https://en.wikipedia.org/wiki/Base64) encoded value prefixed with `@b64@`: simply define its value as the [Base64](https://en.wikipedia.org/wiki/Base64) encoded value prefixed with `@b64@`:
...@@ -269,7 +267,7 @@ This job performs a [Lint](https://github.com/hadolint/hadolint) on your `Docker ...@@ -269,7 +267,7 @@ This job performs a [Lint](https://github.com/hadolint/hadolint) on your `Docker
It is bound to the `build` stage, and uses the following variables: It is bound to the `build` stage, and uses the following variables:
| Input / Variable | Description | Default value | | Input / Variable | Description | Default value |
| -------------------------- | -------------------------------------- | --------------------------------------- | | ------------------------------------------------ | --------------------------------- | --------------------------------------------------------- |
| `hadolint-disabled` / `DOCKER_HADOLINT_DISABLED` | Set to `true` to disable Hadolint | _(none: enabled by default)_ | | `hadolint-disabled` / `DOCKER_HADOLINT_DISABLED` | Set to `true` to disable Hadolint | _(none: enabled by default)_ |
| `hadolint-image` / `DOCKER_HADOLINT_IMAGE` | The Hadolint image | `registry.hub.docker.com/hadolint/hadolint:latest-alpine` | | `hadolint-image` / `DOCKER_HADOLINT_IMAGE` | The Hadolint image | `registry.hub.docker.com/hadolint/hadolint:latest-alpine` |
| `hadolint-args` / `DOCKER_HADOLINT_ARGS` | Additional `hadolint` arguments | _(none)_ | | `hadolint-args` / `DOCKER_HADOLINT_ARGS` | Additional `hadolint` arguments | _(none)_ |
...@@ -289,7 +287,7 @@ RUN cd /tmp && echo "hello!" ...@@ -289,7 +287,7 @@ RUN cd /tmp && echo "hello!"
In addition to a textual report in the console, this job produces the following reports, kept for one day: In addition to a textual report in the console, this job produces the following reports, kept for one day:
| Report | Format | Usage | | Report | Format | Usage |
| -------------- | ---------------------------------------------------------------------------- | ----------------- | | -------------------------------------------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `reports/docker-hadolint-*.native.json` | native hadolint test report (json) | [DefectDojo integration](https://defectdojo.github.io/django-DefectDojo/integrations/parsers/#hadolint)<br/>_This report is generated only if DefectDojo template is detected_ | | `reports/docker-hadolint-*.native.json` | native hadolint test report (json) | [DefectDojo integration](https://defectdojo.github.io/django-DefectDojo/integrations/parsers/#hadolint)<br/>_This report is generated only if DefectDojo template is detected_ |
| `reports/docker-hadolint-*.codeclimate.json` | hadolint (GitLab) codeclimate format | [GitLab integration](https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportscodequality) | | `reports/docker-hadolint-*.codeclimate.json` | hadolint (GitLab) codeclimate format | [GitLab integration](https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportscodequality) |
...@@ -300,7 +298,7 @@ This job builds the image and publishes it to the _snapshot_ repository. ...@@ -300,7 +298,7 @@ This job builds the image and publishes it to the _snapshot_ repository.
It is bound to the `package-build` stage, and uses the following variables: It is bound to the `package-build` stage, and uses the following variables:
| Input / Variable | Description | Default value | | Input / Variable | Description | Default value |
| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ | | ----------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------ |
| `build-args` / `DOCKER_BUILD_ARGS` | Additional `docker/kaniko/buildah` `build` arguments | _(none)_ | | `build-args` / `DOCKER_BUILD_ARGS` | Additional `docker/kaniko/buildah` `build` arguments | _(none)_ |
| `registry-mirror` / `DOCKER_REGISTRY_MIRROR` | URL of a Docker registry mirror to use during the image build (instead of default `https://index.docker.io`) <br>:warning: Used by the `kaniko` and `dind` options only | _(none)_ | | `registry-mirror` / `DOCKER_REGISTRY_MIRROR` | URL of a Docker registry mirror to use during the image build (instead of default `https://index.docker.io`) <br>:warning: Used by the `kaniko` and `dind` options only | _(none)_ |
| `container-registries-config-file` / `CONTAINER_REGISTRIES_CONFIG_FILE` | The [`registries.conf`](https://www.redhat.com/sysadmin/manage-container-registries) configuration to be used<br>:warning: Used by the `buildah` build only | _(none)_ | | `container-registries-config-file` / `CONTAINER_REGISTRIES_CONFIG_FILE` | The [`registries.conf`](https://www.redhat.com/sysadmin/manage-container-registries) configuration to be used<br>:warning: Used by the `buildah` build only | _(none)_ |
...@@ -311,7 +309,7 @@ It is bound to the `package-build` stage, and uses the following variables: ...@@ -311,7 +309,7 @@ It is bound to the `package-build` stage, and uses the following variables:
This job produces _output variables_ that are propagated to downstream jobs (using [dotenv artifacts](https://docs.gitlab.com/ee/ci/pipelines/job_artifacts.html#artifactsreportsdotenv)): This job produces _output variables_ that are propagated to downstream jobs (using [dotenv artifacts](https://docs.gitlab.com/ee/ci/pipelines/job_artifacts.html#artifactsreportsdotenv)):
| Input / Variable | Description | Example | | Input / Variable | Description | Example |
| --------------------- | ------------------------------------------------------ | --------------------------------------- | | --------------------- | ------------------------------------------------------ | -------------------------------------------------------------- |
| `docker_image` | snapshot image name **with tag** | `registry.gitlab.com/acme/website/snapshot:main` | | `docker_image` | snapshot image name **with tag** | `registry.gitlab.com/acme/website/snapshot:main` |
| `docker_image_digest` | snapshot image name **with digest** (no tag) | `registry.gitlab.com/acme/website/snapshot@sha256:b7914a91...` | | `docker_image_digest` | snapshot image name **with digest** (no tag) | `registry.gitlab.com/acme/website/snapshot@sha256:b7914a91...` |
| `docker_repository` | snapshot image **bare repository** (no tag nor digest) | `registry.gitlab.com/acme/website/snapshot` | | `docker_repository` | snapshot image **bare repository** (no tag nor digest) | `registry.gitlab.com/acme/website/snapshot` |
...@@ -361,7 +359,7 @@ DOCKER_BUILD_ARGS: "--label org.opencontainers.image.title=my-project" ...@@ -361,7 +359,7 @@ DOCKER_BUILD_ARGS: "--label org.opencontainers.image.title=my-project"
If a label contains spaces then quotes need to be correctly escaped: If a label contains spaces then quotes need to be correctly escaped:
```yaml ```yaml
DOCKER_BUILD_ARGS: "--label \"org.opencontainers.image.title=my project\"" DOCKER_BUILD_ARGS: '--label "org.opencontainers.image.title=my project"'
``` ```
or or
...@@ -385,13 +383,13 @@ This job performs a [Health Check](https://docs.docker.com/engine/reference/buil ...@@ -385,13 +383,13 @@ This job performs a [Health Check](https://docs.docker.com/engine/reference/buil
It is bound to the `package-test` stage, and uses the following variables: It is bound to the `package-test` stage, and uses the following variables:
| Input / Variable | Description | Default value | | Input / Variable | Description | Default value |
| -------------------------------------- | -------------------------------------------------------------------- | ----------------- | | ------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- |
| `healthcheck-disabled` / `DOCKER_HEALTHCHECK_DISABLED` | Set to `true` to disable health check | _(none: enabled by default)_ | | `healthcheck-disabled` / `DOCKER_HEALTHCHECK_DISABLED` | Set to `true` to disable health check | _(none: enabled by default)_ |
| `healthcheck-timeout` / `DOCKER_HEALTHCHECK_TIMEOUT` | When testing a Docker Health (test stage), how long (in seconds) wait for the [HealthCheck status](https://docs.docker.com/engine/reference/builder/#healthcheck) | `60` | | `healthcheck-timeout` / `DOCKER_HEALTHCHECK_TIMEOUT` | When testing a Docker Health (test stage), how long (in seconds) wait for the [HealthCheck status](https://docs.docker.com/engine/reference/builder/#healthcheck) | `60` |
| `healthcheck-options` / `DOCKER_HEALTHCHECK_OPTIONS` | Docker options for health check such as port mapping, environment... | _(none)_ | | `healthcheck-options` / `DOCKER_HEALTHCHECK_OPTIONS` | Docker options for health check such as port mapping, environment... | _(none)_ |
| `healthcheck-container-args` / `DOCKER_HEALTHCHECK_CONTAINER_ARGS` | Set arguments sent to the running container for health check | _(none)_ | | `healthcheck-container-args` / `DOCKER_HEALTHCHECK_CONTAINER_ARGS` | Set arguments sent to the running container for health check | _(none)_ |
In case your Docker image is not intended to run as a service and only contains a *client tool* (like curl, Ansible, ...) you can test it by overriding the Health Check Job. See [this example](#overriding-docker-healthcheck). In case your Docker image is not intended to run as a service and only contains a _client tool_ (like curl, Ansible, ...) you can test it by overriding the Health Check Job. See [this example](#overriding-docker-healthcheck).
:warning: Keep in mind that the downloading of the snapshot image by the GitLab runner will be done during the waiting time (max `DOCKER_HEALTHCHECK_TIMEOUT`). :warning: Keep in mind that the downloading of the snapshot image by the GitLab runner will be done during the waiting time (max `DOCKER_HEALTHCHECK_TIMEOUT`).
In case your image takes quite some time to be downloaded by the runner, increase the value of `DOCKER_HEALTHCHECK_TIMEOUT` in your `.gitlab-ci.yml` file. In case your image takes quite some time to be downloaded by the runner, increase the value of `DOCKER_HEALTHCHECK_TIMEOUT` in your `.gitlab-ci.yml` file.
...@@ -412,19 +410,19 @@ variables: ...@@ -412,19 +410,19 @@ variables:
It is bound to the `package-test` stage, and uses the following variables: It is bound to the `package-test` stage, and uses the following variables:
| Input / Variable | Description | Default value | | Input / Variable | Description | Default value |
| ---------------------- | -------------------------------------- | ----------------- | | -------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
| `trivy-image` / `DOCKER_TRIVY_IMAGE` | The docker image used to scan images with Trivy | `registry.hub.docker.com/aquasec/trivy:latest` | | `trivy-image` / `DOCKER_TRIVY_IMAGE` | The docker image used to scan images with Trivy | `registry.hub.docker.com/aquasec/trivy:latest` |
| `trivy-addr` / `DOCKER_TRIVY_ADDR` | The Trivy server address (for client/server mode) | _(none: standalone mode)_ | | `trivy-addr` / `DOCKER_TRIVY_ADDR` | The Trivy server address (for client/server mode) | _(none: standalone mode)_ |
| `trivy-security-level-threshold` / `DOCKER_TRIVY_SECURITY_LEVEL_THRESHOLD` | Severities of vulnerabilities to be displayed (comma separated values: `UNKNOWN`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`) | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | | `trivy-security-level-threshold` / `DOCKER_TRIVY_SECURITY_LEVEL_THRESHOLD` | Severities of vulnerabilities to be displayed (comma separated values: `UNKNOWN`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`) | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` |
| `trivy-disabled` / `DOCKER_TRIVY_DISABLED` | Set to `true` to disable Trivy analysis | _(none)_ | | `trivy-disabled` / `DOCKER_TRIVY_DISABLED` | Set to `true` to disable Trivy analysis | _(none)_ |
| `trivy-args` / `DOCKER_TRIVY_ARGS` | Additional [`trivy client` arguments](https://aquasecurity.github.io/trivy/v0.27.1/docs/references/cli/client/) | `--ignore-unfixed --vuln-type os` | | `trivy-args` / `DOCKER_TRIVY_ARGS` | Additional [`trivy client` arguments](https://aquasecurity.github.io/trivy/v0.27.1/docs/references/cli/client/) | `--ignore-unfixed --vuln-type os` |
| `trivy-db-repository` / `DOCKER_TRIVY_DB_REPOSITORY` | OCI repository to retrieve Trivy Database from | _none_ (use Trivy default `ghcr.io/aquasecurity/trivy-db`) | | `trivy-db-repository` / `DOCKER_TRIVY_DB_REPOSITORY` | OCI repository to retrieve Trivy Database from | _none_ (use Trivy default `ghcr.io/aquasecurity/trivy-db`) |
| `trivy-java-db-repository` / `DOCKER_TRIVY_JAVA_DB_REPOSITORY` | OCI repository to retrieve Trivy Java Database from | _none_ (use Trivy default `ghcr.io/aquasecurity/trivy-java-db:1`)_ | | `trivy-java-db-repository` / `DOCKER_TRIVY_JAVA_DB_REPOSITORY` | OCI repository to retrieve Trivy Java Database from | _none_ (use Trivy default `ghcr.io/aquasecurity/trivy-java-db:1`)\_ |
In addition to a textual report in the console, this job produces the following reports, kept for one day: In addition to a textual report in the console, this job produces the following reports, kept for one day:
| Report | Format | Usage | | Report | Format | Usage |
| -------------- | ---------------------------------------------------------------------------- | ----------------- | | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `reports/docker-trivy-*.native.json` | native Trivy report format (json) | [DefectDojo integration](https://defectdojo.github.io/django-DefectDojo/integrations/parsers/#trivy)<br/>_This report is generated only if DefectDojo template is detected_ | | `reports/docker-trivy-*.native.json` | native Trivy report format (json) | [DefectDojo integration](https://defectdojo.github.io/django-DefectDojo/integrations/parsers/#trivy)<br/>_This report is generated only if DefectDojo template is detected_ |
| `reports/docker-trivy-*.gitlab.json` | [Trivy report format for GitLab](https://aquasecurity.github.io/trivy/v0.30.4/docs/integrations/gitlab-ci/) format | [GitLab integration](https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportscontainer_scanning) | | `reports/docker-trivy-*.gitlab.json` | [Trivy report format for GitLab](https://aquasecurity.github.io/trivy/v0.30.4/docs/integrations/gitlab-ci/) format | [GitLab integration](https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportscontainer_scanning) |
...@@ -435,7 +433,7 @@ This job generates a [SBOM](https://cyclonedx.org/) file listing installed packa ...@@ -435,7 +433,7 @@ This job generates a [SBOM](https://cyclonedx.org/) file listing installed packa
It is bound to the `package-test` stage, and uses the following variables: It is bound to the `package-test` stage, and uses the following variables:
| Input / Variable | Description | Default value | | Input / Variable | Description | Default value |
| --------------------- | -------------------------------------- | ----------------- | | ---------------------------------------- | --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| `sbom-disabled` / `DOCKER_SBOM_DISABLED` | Set to `true` to disable this job | _none_ | | `sbom-disabled` / `DOCKER_SBOM_DISABLED` | Set to `true` to disable this job | _none_ |
| `sbom-image` / `DOCKER_SBOM_IMAGE` | The docker image used to emit SBOM | `registry.hub.docker.com/anchore/syft:debug` | | `sbom-image` / `DOCKER_SBOM_IMAGE` | The docker image used to emit SBOM | `registry.hub.docker.com/anchore/syft:debug` |
| `sbom-opts` / `DOCKER_SBOM_OPTS` | Options for syft used for SBOM analysis | `--override-default-catalogers rpm-db-cataloger,alpm-db-cataloger,apk-db-cataloger,dpkg-db-cataloger,portage-cataloger` | | `sbom-opts` / `DOCKER_SBOM_OPTS` | Options for syft used for SBOM analysis | `--override-default-catalogers rpm-db-cataloger,alpm-db-cataloger,apk-db-cataloger,dpkg-db-cataloger,portage-cataloger` |
...@@ -445,7 +443,7 @@ It is bound to the `package-test` stage, and uses the following variables: ...@@ -445,7 +443,7 @@ It is bound to the `package-test` stage, and uses the following variables:
This job pushes (_promotes_) the built image as the _release_ image [skopeo](https://github.com/containers/skopeo). This job pushes (_promotes_) the built image as the _release_ image [skopeo](https://github.com/containers/skopeo).
| Input / Variable | Description | Default value | | Input / Variable | Description | Default value |
| --------------------- | --------------------------------------------------------------------------- | ----------------- | | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `skopeo-image` / `DOCKER_SKOPEO_IMAGE` | The Docker image used to run [skopeo](https://github.com/containers/skopeo) | `quay.io/skopeo/stable:latest` | | `skopeo-image` / `DOCKER_SKOPEO_IMAGE` | The Docker image used to run [skopeo](https://github.com/containers/skopeo) | `quay.io/skopeo/stable:latest` |
| `publish-args` / `DOCKER_PUBLISH_ARGS` | Additional [`skopeo copy` arguments](https://github.com/containers/skopeo/blob/master/docs/skopeo-copy.1.md#options) | _(none)_ | | `publish-args` / `DOCKER_PUBLISH_ARGS` | Additional [`skopeo copy` arguments](https://github.com/containers/skopeo/blob/master/docs/skopeo-copy.1.md#options) | _(none)_ |
| `prod-publish-strategy` / `DOCKER_PROD_PUBLISH_STRATEGY` | Defines the publish to production strategy. One of `manual` (i.e. _one-click_), `auto` or `none` (disabled). | `manual` | | `prod-publish-strategy` / `DOCKER_PROD_PUBLISH_STRATEGY` | Defines the publish to production strategy. One of `manual` (i.e. _one-click_), `auto` or `none` (disabled). | `manual` |
...@@ -456,7 +454,7 @@ This job pushes (_promotes_) the built image as the _release_ image [skopeo](htt ...@@ -456,7 +454,7 @@ This job pushes (_promotes_) the built image as the _release_ image [skopeo](htt
This job produces _output variables_ that are propagated to downstream jobs (using [dotenv artifacts](https://docs.gitlab.com/ee/ci/pipelines/job_artifacts.html#artifactsreportsdotenv)): This job produces _output variables_ that are propagated to downstream jobs (using [dotenv artifacts](https://docs.gitlab.com/ee/ci/pipelines/job_artifacts.html#artifactsreportsdotenv)):
| Input / Variable | Description | Example | | Input / Variable | Description | Example |
| --------------------- | ----------------------------------------------------- | --------------------------------------- | | --------------------- | ----------------------------------------------------- | ----------------------------------------------------- |
| `docker_image` | release image name **with tag** | `registry.gitlab.com/acme/website:main` | | `docker_image` | release image name **with tag** | `registry.gitlab.com/acme/website:main` |
| `docker_image_digest` | release image name **with digest** (no tag) | `registry.gitlab.com/acme/website@sha256:b7914a91...` | | `docker_image_digest` | release image name **with digest** (no tag) | `registry.gitlab.com/acme/website@sha256:b7914a91...` |
| `docker_repository` | release image **bare repository** (no tag nor digest) | `registry.gitlab.com/acme/website` | | `docker_repository` | release image **bare repository** (no tag nor digest) | `registry.gitlab.com/acme/website` |
...@@ -469,26 +467,26 @@ They may be freely used in downstream jobs (for instance to deploy the upstream ...@@ -469,26 +467,26 @@ They may be freely used in downstream jobs (for instance to deploy the upstream
When publishing the _release_ image, the Docker template might publish it again with additional tags (aliases): When publishing the _release_ image, the Docker template might publish it again with additional tags (aliases):
* the original published image tag (extracted from `$DOCKER_RELEASE_IMAGE`) must match `$DOCKER_RELEASE_EXTRA_TAGS_PATTERN` ([semantic versioning](https://semver.org/) pattern by default), - the original published image tag (extracted from `$DOCKER_RELEASE_IMAGE`) must match `$DOCKER_RELEASE_EXTRA_TAGS_PATTERN` ([semantic versioning](https://semver.org/) pattern by default),
* extra tags to publish can be defined in the `$DOCKER_RELEASE_EXTRA_TAGS` variable, each separated with a whitespace. - extra tags to publish can be defined in the `$DOCKER_RELEASE_EXTRA_TAGS` variable, each separated with a whitespace.
:information_source: the Docker template supports [group references substitution](https://learnbyexample.github.io/py_regular_expressions/groupings-and-backreferences.html) to evaluate extra tags: :information_source: the Docker template supports [group references substitution](https://learnbyexample.github.io/py_regular_expressions/groupings-and-backreferences.html) to evaluate extra tags:
* `$DOCKER_RELEASE_EXTRA_TAGS_PATTERN` supports capturing groups: - `$DOCKER_RELEASE_EXTRA_TAGS_PATTERN` supports capturing groups:
* `v([0-9]+)\.([0-9]+)\.([0-9]+)` has 3 (unnamed) capturing groups, each capturing any number of digits - `v([0-9]+)\.([0-9]+)\.([0-9]+)` has 3 (unnamed) capturing groups, each capturing any number of digits
* `v(?<major>[0-9]+)\.(?<minor>[0-9]+)\.(?<patch>[0-9]+)` has 3 **named** capturing groups (_major_, _minor_ and _patch_), each capturing any number of digits - `v(?<major>[0-9]+)\.(?<minor>[0-9]+)\.(?<patch>[0-9]+)` has 3 **named** capturing groups (_major_, _minor_ and _patch_), each capturing any number of digits
* `$DOCKER_RELEASE_EXTRA_TAGS` supports capturing group references from `$DOCKER_RELEASE_EXTRA_TAGS_PATTERN`: - `$DOCKER_RELEASE_EXTRA_TAGS` supports capturing group references from `$DOCKER_RELEASE_EXTRA_TAGS_PATTERN`:
* `\g1` is a reference to capturing group number 1 - `\g1` is a reference to capturing group number 1
* `\g<major>` is a reference to capturing group named _major_ - `\g<major>` is a reference to capturing group named _major_
:information_source: the default value of `$DOCKER_RELEASE_EXTRA_TAGS_PATTERN` matches and captures all parts of a standard [semantic versioning](https://semver.org/)-compliant tag: :information_source: the default value of `$DOCKER_RELEASE_EXTRA_TAGS_PATTERN` matches and captures all parts of a standard [semantic versioning](https://semver.org/)-compliant tag:
* the **major** group captures the major version - the **major** group captures the major version
* the **minor** group captures the minor version - the **minor** group captures the minor version
* the **patch** group captures the patch version - the **patch** group captures the patch version
* the **prerelease** group captures the (optional) pre-release version (including the leading `-`) - the **prerelease** group captures the (optional) pre-release version (including the leading `-`)
* the **build** group captures the (optional) build version (including the leading `+`) - the **build** group captures the (optional) build version (including the leading `+`)
* the **suffix** group captures the (optional) entire suffix (including pre-release and/or build) - the **suffix** group captures the (optional) entire suffix (including pre-release and/or build)
Example: publish latest, major.minor and major aliases for a SemVer release: Example: publish latest, major.minor and major aliases for a SemVer release:
...@@ -501,7 +499,7 @@ variables: ...@@ -501,7 +499,7 @@ variables:
With this contiguration, the following extra tags would be published: With this contiguration, the following extra tags would be published:
| original tag | extra tags | | original tag | extra tags |
| --------------------- | ---------- | | ---------------------- | ----------------------------------------------------------- |
| `main` | _none_ (doesn't match `$DOCKER_RELEASE_EXTRA_TAGS_PATTERN`) | | `main` | _none_ (doesn't match `$DOCKER_RELEASE_EXTRA_TAGS_PATTERN`) |
| `some-manual-tag` | _none_ (doesn't match `$DOCKER_RELEASE_EXTRA_TAGS_PATTERN`) | | `some-manual-tag` | _none_ (doesn't match `$DOCKER_RELEASE_EXTRA_TAGS_PATTERN`) |
| `1.2.3` | `latest`, `1.2`, `1` | | `1.2.3` | `latest`, `1.2`, `1` |
...@@ -513,8 +511,8 @@ With this contiguration, the following extra tags would be published: ...@@ -513,8 +511,8 @@ With this contiguration, the following extra tags would be published:
If you activate the [`semantic-release-info` job from the `semantic-release` template](https://gitlab.com/to-be-continuous/semantic-release/#semantic-release-info-job), the `docker-publish` job will rely on the generated next version info. If you activate the [`semantic-release-info` job from the `semantic-release` template](https://gitlab.com/to-be-continuous/semantic-release/#semantic-release-info-job), the `docker-publish` job will rely on the generated next version info.
* the release will only be performed if a semantic release is present - the release will only be performed if a semantic release is present
* the tag will be based on `SEMREL_INFO_NEXT_VERSION`, it will override `DOCKER_RELEASE_IMAGE` by simply substituting the tag, or adding a tag when there's none. - the tag will be based on `SEMREL_INFO_NEXT_VERSION`, it will override `DOCKER_RELEASE_IMAGE` by simply substituting the tag, or adding a tag when there's none.
For instance, in both cases: For instance, in both cases:
...@@ -522,9 +520,10 @@ For instance, in both cases: ...@@ -522,9 +520,10 @@ For instance, in both cases:
DOCKER_RELEASE_IMAGE: "registry.gitlab.com/$CI_PROJECT_NAME" DOCKER_RELEASE_IMAGE: "registry.gitlab.com/$CI_PROJECT_NAME"
DOCKER_RELEASE_IMAGE: "registry.gitlab.com/$CI_PROJECT_NAME:$CI_COMMIT_REF_NAME" DOCKER_RELEASE_IMAGE: "registry.gitlab.com/$CI_PROJECT_NAME:$CI_COMMIT_REF_NAME"
``` ```
The published Docker image will be `registry.gitlab.com/$CI_PROJECT_NAME:$SEMREL_INFO_NEXT_VERSION` and all subsequent jobs relying on the `docker_image` variable will be provided with this tag. The published Docker image will be `registry.gitlab.com/$CI_PROJECT_NAME:$SEMREL_INFO_NEXT_VERSION` and all subsequent jobs relying on the `docker_image` variable will be provided with this tag.
:warning: When `semantic-release` detects no release (i.e. either the semantic-release template is misconfigured, or there were simply no `feat`/`fix` commits), the `docker-publish` job will report a warning and *no image will be pushed* in the release registry. In such a case, the `docker_image` remains unchanged, and will refer to the snapshot image. Any subsequent job that may deploy to production (Kubernetes or Openshift), should thus be configured *not to deploy* in this situation. Refer to deployment template for more information. :warning: When `semantic-release` detects no release (i.e. either the semantic-release template is misconfigured, or there were simply no `feat`/`fix` commits), the `docker-publish` job will report a warning and _no image will be pushed_ in the release registry. In such a case, the `docker_image` remains unchanged, and will refer to the snapshot image. Any subsequent job that may deploy to production (Kubernetes or Openshift), should thus be configured _not to deploy_ in this situation. Refer to deployment template for more information.
Finally, the semantic-release integration can be disabled with the `DOCKER_SEMREL_RELEASE_DISABLED` variable. Finally, the semantic-release integration can be disabled with the `DOCKER_SEMREL_RELEASE_DISABLED` variable.
...@@ -544,7 +543,7 @@ Here is a `.gitlab-ci.yaml` using an external Docker registry: ...@@ -544,7 +543,7 @@ Here is a `.gitlab-ci.yaml` using an external Docker registry:
```yaml ```yaml
include: include:
- component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@5.7.0 - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@5.11.1
inputs: inputs:
snapshot-image: "registry.acme.host/$CI_PROJECT_NAME/snapshot:$CI_COMMIT_REF_SLUG" snapshot-image: "registry.acme.host/$CI_PROJECT_NAME/snapshot:$CI_COMMIT_REF_SLUG"
release-image: "registry.acme.host/$CI_PROJECT_NAME:$CI_COMMIT_REF_NAME" release-image: "registry.acme.host/$CI_PROJECT_NAME:$CI_COMMIT_REF_NAME"
...@@ -559,7 +558,7 @@ Here is a `.gitlab-ci.yaml` that builds 2 Docker images from the same project (u ...@@ -559,7 +558,7 @@ Here is a `.gitlab-ci.yaml` that builds 2 Docker images from the same project (u
```yaml ```yaml
include: include:
- component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@5.7.0 - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@5.11.1
.docker-base: .docker-base:
parallel: parallel:
...@@ -585,7 +584,7 @@ This variant allows delegating your secrets management to a [Vault](https://www. ...@@ -585,7 +584,7 @@ This variant allows delegating your secrets management to a [Vault](https://www.
In order to be able to communicate with the Vault server, the variant requires the additional configuration parameters: In order to be able to communicate with the Vault server, the variant requires the additional configuration parameters:
| Input / Variable | Description | Default value | | Input / Variable | Description | Default value |
| ----------------- | -------------------------------------- | ----------------- | | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------- |
| `TBC_VAULT_IMAGE` | The [Vault Secrets Provider](https://gitlab.com/to-be-continuous/tools/vault-secrets-provider) image to use (can be overridden) | `registry.gitlab.com/to-be-continuous/tools/vault-secrets-provider:latest` | | `TBC_VAULT_IMAGE` | The [Vault Secrets Provider](https://gitlab.com/to-be-continuous/tools/vault-secrets-provider) image to use (can be overridden) | `registry.gitlab.com/to-be-continuous/tools/vault-secrets-provider:latest` |
| `vault-base-url` / `VAULT_BASE_URL` | The Vault server base API url | _none_ | | `vault-base-url` / `VAULT_BASE_URL` | The Vault server base API url | _none_ |
| `vault-oidc-aud` / `VAULT_OIDC_AUD` | The `aud` claim for the JWT | `$CI_SERVER_URL` | | `vault-oidc-aud` / `VAULT_OIDC_AUD` | The `aud` claim for the JWT | `$CI_SERVER_URL` |
...@@ -603,7 +602,7 @@ Then you may retrieve any of your secret(s) from Vault using the following synta ...@@ -603,7 +602,7 @@ Then you may retrieve any of your secret(s) from Vault using the following synta
With: With:
| Parameter | Description | | Parameter | Description |
| -------------------------------- | -------------------------------------- | | -------------------------------- | --------------------------------------------------------------------- |
| `secret_path` (_path parameter_) | this is your secret location in the Vault server | | `secret_path` (_path parameter_) | this is your secret location in the Vault server |
| `field` (_query parameter_) | parameter to access a single basic field from the secret JSON payload | | `field` (_query parameter_) | parameter to access a single basic field from the secret JSON payload |
...@@ -612,7 +611,7 @@ With: ...@@ -612,7 +611,7 @@ With:
```yaml ```yaml
include: include:
# main template # main template
- component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@5.7.0 - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@5.11.1
# Vault variant # Vault variant
- component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker-vault@5.7.0 - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker-vault@5.7.0
inputs: inputs:
...@@ -644,7 +643,7 @@ List of requirements before using this variant for publishing your container ima ...@@ -644,7 +643,7 @@ List of requirements before using this variant for publishing your container ima
#### Configuration #### Configuration
| Input / Variable | Description | Default value | | Input / Variable | Description | Default value |
| ------------------------ | -------------------------------------- | ----------------- | | ----------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- |
| `TBC_GCP_PROVIDER_IMAGE` | The [GCP Auth Provider](https://gitlab.com/to-be-continuous/tools/gcp-auth-provider) image to use (can be overridden) | `registry.gitlab.com/to-be-continuous/tools/gcp-auth-provider:latest` | | `TBC_GCP_PROVIDER_IMAGE` | The [GCP Auth Provider](https://gitlab.com/to-be-continuous/tools/gcp-auth-provider) image to use (can be overridden) | `registry.gitlab.com/to-be-continuous/tools/gcp-auth-provider:latest` |
| `gcp-oidc-aud` / `GCP_OIDC_AUD` | The `aud` claim for the JWT token | `$CI_SERVER_URL` | | `gcp-oidc-aud` / `GCP_OIDC_AUD` | The `aud` claim for the JWT token | `$CI_SERVER_URL` |
| `gcp-oidc-provider` / `GCP_OIDC_PROVIDER` | Default Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) | _none_ | | `gcp-oidc-provider` / `GCP_OIDC_PROVIDER` | Default Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) | _none_ |
...@@ -661,7 +660,7 @@ to use the snapshot image repository (will host your snapshot image as well as c ...@@ -661,7 +660,7 @@ to use the snapshot image repository (will host your snapshot image as well as c
```yaml ```yaml
include: include:
- component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@5.7.0 - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@5.11.1
inputs: inputs:
build-tool: "kaniko" # Only Kaniko has been proved to work for this use case YET build-tool: "kaniko" # Only Kaniko has been proved to work for this use case YET
# untested & unverified container image # untested & unverified container image
...@@ -698,7 +697,7 @@ In order to use the AWS APIs, the variant supports two authentication methods: ...@@ -698,7 +697,7 @@ In order to use the AWS APIs, the variant supports two authentication methods:
#### Configuration #### Configuration
| Input / Variable | Description | Default value | | Input / Variable | Description | Default value |
| ------------------------ | -------------------------------------- | ----------------- | | --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- |
| `TBC_AWS_PROVIDER_IMAGE` | The [AWS Auth Provider](https://gitlab.com/to-be-continuous/tools/aws-auth-provider) image to use (can be overridden) | `registry.gitlab.com/to-be-continuous/tools/aws-auth-provider:latest` | | `TBC_AWS_PROVIDER_IMAGE` | The [AWS Auth Provider](https://gitlab.com/to-be-continuous/tools/aws-auth-provider) image to use (can be overridden) | `registry.gitlab.com/to-be-continuous/tools/aws-auth-provider:latest` |
| `aws-region` / `AWS_REGION` | Default region (where the ECR registry is located) | _none_ | | `aws-region` / `AWS_REGION` | Default region (where the ECR registry is located) | _none_ |
| `aws-snapshot-region` / `AWS_SNAPSHOT_REGION` | Region of the ECR registry for the snapshot image _(only define to override default)_ | _none_ | | `aws-snapshot-region` / `AWS_SNAPSHOT_REGION` | Region of the ECR registry for the snapshot image _(only define to override default)_ | _none_ |
...@@ -713,7 +712,7 @@ This is the recommended authentication method. In order to use it, first careful ...@@ -713,7 +712,7 @@ This is the recommended authentication method. In order to use it, first careful
then set the required configuration. then set the required configuration.
| Input / Variable | Description | Default value | | Input / Variable | Description | Default value |
| ------------------------ | -------------------------------------- | ----------------- | | ----------------------------------------------------------- | ---------------------------------------------------------------------------------------------- | ---------------- |
| `aws-oidc-aud` / `AWS_OIDC_AUD` | The `aud` claim for the JWT token | `$CI_SERVER_URL` | | `aws-oidc-aud` / `AWS_OIDC_AUD` | The `aud` claim for the JWT token | `$CI_SERVER_URL` |
| `aws-oidc-role-arn` / `AWS_OIDC_ROLE_ARN` | Default IAM Role ARN associated with GitLab | _none_ | | `aws-oidc-role-arn` / `AWS_OIDC_ROLE_ARN` | Default IAM Role ARN associated with GitLab | _none_ |
| `aws-snapshot-oidc-role-arn` / `AWS_SNAPSHOT_OIDC_ROLE_ARN` | IAM Role ARN associated with GitLab for the snapshot image _(only define to override default)_ | _none_ | | `aws-snapshot-oidc-role-arn` / `AWS_SNAPSHOT_OIDC_ROLE_ARN` | IAM Role ARN associated with GitLab for the snapshot image _(only define to override default)_ | _none_ |
...@@ -722,7 +721,7 @@ then set the required configuration. ...@@ -722,7 +721,7 @@ then set the required configuration.
##### Basic authentication config ##### Basic authentication config
| Variable | Description | Default value | | Variable | Description | Default value |
| ------------------------ | -------------------------------------- | ----------------- | | --------------------------------------- | ---------------------------------------------------------------------------- | ----------------- |
| :lock: `AWS_ACCESS_KEY_ID` | Default access key ID | _none_ (disabled) | | :lock: `AWS_ACCESS_KEY_ID` | Default access key ID | _none_ (disabled) |
| :lock: `AWS_SECRET_ACCESS_KEY` | Default secret access key | _none_ (disabled) | | :lock: `AWS_SECRET_ACCESS_KEY` | Default secret access key | _none_ (disabled) |
| :lock: `AWS_SNAPSHOT_ACCESS_KEY_ID` | Access key ID for the snapshot image _(only define to override default)_ | _none_ | | :lock: `AWS_SNAPSHOT_ACCESS_KEY_ID` | Access key ID for the snapshot image _(only define to override default)_ | _none_ |
...@@ -734,7 +733,7 @@ then set the required configuration. ...@@ -734,7 +733,7 @@ then set the required configuration.
```yaml ```yaml
include: include:
- component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@5.7.0 - component: $CI_SERVER_FQDN/to-be-continuous/docker/gitlab-ci-docker@5.11.1
inputs: inputs:
# untested & unverified container image # untested & unverified container image
snapshot-image: "123456789012.dkr.ecr.us-east-1.amazonaws.com/$CI_PROJECT_PATH_SLUG/snapshot:$CI_COMMIT_REF_SLUG" snapshot-image: "123456789012.dkr.ecr.us-east-1.amazonaws.com/$CI_PROJECT_PATH_SLUG/snapshot:$CI_COMMIT_REF_SLUG"
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment