nhyatt/build-containers
Archived
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

adds cosign to kaniko

Browse Source
This commit is contained in:
Hyatt 2022-01-03 10:43:34 -06:00
parent 16c1a4530a
commit 27cedaa566
Signed by: nhyatt
GPG Key ID: C50D0BBB5BC40BEA
1 changed files with 64 additions and 48 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

112
build-kaniko.jenkins
View File

@ -4,9 +4,9 @@ def repository = "registry.c.test-chamber-13.lan"
def repositoryCreds = "harbor-repository-creds" def repositoryCreds = "harbor-repository-creds"
podTemplate( podTemplate(
label: label, label: label,
name: "pipeline-worker", name: "pipeline-worker",
yaml: """--- yaml: """---
apiVersion: v1 apiVersion: v1
kind: Pod kind: Pod
metadata: metadata:
@ -19,56 +19,72 @@ spec:
tty: true tty: true
command: command:
- /busybox/cat - /busybox/cat
- name: alpine
imagePullPolicy: Always
image: ${repository}/library/alpine:latest
tty: true
command:
- /bin/sh
""", """,
) { ) {
node (label) { node (label) {
def workspace = pwd() def workspace = pwd()
stage ("Prepare Kaniko") { stage ("Get CoSign") {
container ("kaniko") { container ("alpine") {
withCredentials([usernameColonPassword( sh """
credentialsId: repositoryCreds, apk add --no-cache curl jq
variable: "dCreds", curl --silent --location "\$(curl --silent "https://api.github.com/repos/sigstore/cosign/releases/latest" | jq -r '.assets[0].browser_download_url')" -output "${workspace}/cosign"
)]) { chmod +x "${workspace}/cosign"
def dockerJSON = """{ """
"auths": { }
"${repository}": { }
"auth": "${dcreds.bytes.encodeBase64().toString()}"
}
}
}"""
sh """
set +x
echo '${dockerJSON}' > /kaniko/.docker/config.json
printf '%s\\n' "-----BEGIN CERTIFICATE-----" \\
"MIICLTCCAbOgAwIBAgIDAYagMAoGCCqGSM49BAMEME0xCzAJBgNVBAYTAlVTMScw" \\
"JQYDVQQKDB5UZXN0IENoYW1iZXIgMTMgVHJ1c3QgU2VydmljZXMxFTATBgNVBAMM" \\
"DFRDMTMgUm9vdCBSMTAgFw0xOTAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFow" \\
"TTELMAkGA1UEBhMCVVMxJzAlBgNVBAoMHlRlc3QgQ2hhbWJlciAxMyBUcnVzdCBT" \\
"ZXJ2aWNlczEVMBMGA1UEAwwMVEMxMyBSb290IFIxMHYwEAYHKoZIzj0CAQYFK4EE" \\
"ACIDYgAE8+/J1ECc0VHxTtGXFLnHJ3NGZ2SW38pp9wI58L5EQbHRLiezYuvkUbI/" \\
"XGJjLnFdpgjo7W1FFlyhx5ITlCstUX5Sn9bLZiA0+mE0n6b8VwhXwkHlnIeRo7od" \\
"Zu/OfSFjo2MwYTAdBgNVHQ4EFgQUrGqUJhyRp93wXF645VNtYatRk/AwHwYDVR0j" \\
"BBgwFoAUrGqUJhyRp93wXF645VNtYatRk/AwDwYDVR0TAQH/BAUwAwEB/zAOBgNV" \\
"HQ8BAf8EBAMCAYYwCgYIKoZIzj0EAwQDaAAwZQIxAJdgskimDJkf/MGVRrKotmNC" \\
"xdH/UVQfQppjIR9FAiGeFDr47thclYrzIL6yCkV7nwIwYjf3MbOm/yWblzqe3Uyw" \\
"UOemMEg3PjcKNsN65W2WVon5HIZx2XVfGRPjf5ZTVWzZ" \\
"-----END CERTIFICATE-----" >> /kaniko/ssl/certs/ca-certificates.crt
"""
}
}
}
stage("Build Alpine with CA") { stage ("Prepare Kaniko") {
container("kaniko") { container ("kaniko") {
def DF = """FROM gcr.io/kaniko-project/executor:debug withCredentials([usernameColonPassword(
credentialsId: repositoryCreds,
variable: "dCreds",
)]) {
def dockerJSON = """{
"auths": {
"${repository}": {
"auth": "${dcreds.bytes.encodeBase64().toString()}"
}
}
}"""
sh """
set +x
echo '${dockerJSON}' > /kaniko/.docker/config.json
printf '%s\\n' "-----BEGIN CERTIFICATE-----" \\
"MIICLTCCAbOgAwIBAgIDAYagMAoGCCqGSM49BAMEME0xCzAJBgNVBAYTAlVTMScw" \\
"JQYDVQQKDB5UZXN0IENoYW1iZXIgMTMgVHJ1c3QgU2VydmljZXMxFTATBgNVBAMM" \\
"DFRDMTMgUm9vdCBSMTAgFw0xOTAxMDEwMDAwMDBaGA8yMDUwMDEwMTAwMDAwMFow" \\
"TTELMAkGA1UEBhMCVVMxJzAlBgNVBAoMHlRlc3QgQ2hhbWJlciAxMyBUcnVzdCBT" \\
"ZXJ2aWNlczEVMBMGA1UEAwwMVEMxMyBSb290IFIxMHYwEAYHKoZIzj0CAQYFK4EE" \\
"ACIDYgAE8+/J1ECc0VHxTtGXFLnHJ3NGZ2SW38pp9wI58L5EQbHRLiezYuvkUbI/" \\
"XGJjLnFdpgjo7W1FFlyhx5ITlCstUX5Sn9bLZiA0+mE0n6b8VwhXwkHlnIeRo7od" \\
"Zu/OfSFjo2MwYTAdBgNVHQ4EFgQUrGqUJhyRp93wXF645VNtYatRk/AwHwYDVR0j" \\
"BBgwFoAUrGqUJhyRp93wXF645VNtYatRk/AwDwYDVR0TAQH/BAUwAwEB/zAOBgNV" \\
"HQ8BAf8EBAMCAYYwCgYIKoZIzj0EAwQDaAAwZQIxAJdgskimDJkf/MGVRrKotmNC" \\
"xdH/UVQfQppjIR9FAiGeFDr47thclYrzIL6yCkV7nwIwYjf3MbOm/yWblzqe3Uyw" \\
"UOemMEg3PjcKNsN65W2WVon5HIZx2XVfGRPjf5ZTVWzZ" \\
"-----END CERTIFICATE-----" >> /kaniko/ssl/certs/ca-certificates.crt
"""
}
}
}
stage("Build Alpine with CA") {
container("kaniko") {
def DF = """FROM gcr.io/kaniko-project/executor:debug
COPY ./cosign /busybox/cosign
COPY kaniko-chain.crt /kaniko/ssl/certs/ca-certificates.crt COPY kaniko-chain.crt /kaniko/ssl/certs/ca-certificates.crt
""" """
sh "cp /kaniko/ssl/certs/ca-certificates.crt \"${workspace}/kaniko-chain.crt\"" sh "cp /kaniko/ssl/certs/ca-certificates.crt \"${workspace}/kaniko-chain.crt\""
writeFile(file: workspace + "/Dockerfile", text: DF) writeFile(file: workspace + "/Dockerfile", text: DF)
sh "/kaniko/executor --cleanup --context \"${workspace}\" -f \"${workspace}/Dockerfile\" --destination \"${repository}/library/kaniko:latest\"" sh "/kaniko/executor --cleanup --context \"${workspace}\" -f \"${workspace}/Dockerfile\" --destination \"${repository}/library/kaniko:latest\" --single-snapshot"
} }
} }
} }
} }