4ed66807a0
We have to be careful about avoiding outer loop loop_var conflicts in ansible. Because the zuul-jobs roles are meant to be reconsumed elsewhere we should not use 'item' loopvars and instead set them to something a bit more unique. We use a zj_ prefix to try and be unique to this repo and document this convention. Change-Id: I20b9327a914890e9eafcb2b36dc8c23fb472bc8f
104 lines
4.0 KiB
YAML
104 lines
4.0 KiB
YAML
# This can be removed if we add this functionality to Zuul directly
|
|
- name: Load information from zuul_return
|
|
when: buildset_registry is not defined
|
|
set_fact:
|
|
buildset_registry: "{{ (lookup('file', zuul.executor.work_root + '/results.json') | from_json)['buildset_registry'] }}"
|
|
|
|
# Start a socat tunnel to the buildset registry to work around the
|
|
# fact that docker does not correctly parse ipv6 addresses. The socat
|
|
# process will terminate when the playbook ends.
|
|
- name: Start socat to work around https://github.com/moby/moby/issues/39033
|
|
shell: "socat -d -d TCP-LISTEN:0,fork TCP:{{ buildset_registry.host | ipwrap }}:{{ buildset_registry.port }} 2> {{ zuul.executor.work_root }}/socat_port &"
|
|
|
|
# Use slurp instead of file lookup to make this testable on a fake
|
|
# executor node.
|
|
- name: Read socat port
|
|
slurp:
|
|
src: "{{ zuul.executor.work_root }}/socat_port"
|
|
register: read_socat_port
|
|
- name: Set socat port
|
|
set_fact:
|
|
socat_port: "{{ read_socat_port['content'] | b64decode | regex_replace('.*?0\\.0\\.0\\.0:(\\d+)', '\\1') | regex_replace('\n', '') }}"
|
|
|
|
# Set up cert files for the buildset registry
|
|
- name: Ensure registry cert directory exists
|
|
file:
|
|
path: "/etc/docker/certs.d/127.0.0.1:{{ socat_port }}/"
|
|
state: directory
|
|
- name: Write registry TLS certificate
|
|
copy:
|
|
content: "{{ buildset_registry.cert }}"
|
|
dest: "/etc/docker/certs.d/127.0.0.1:{{ socat_port }}/ca.crt"
|
|
|
|
# Update user config for intermediate and buildset registries
|
|
- name: Ensure docker user directory exists
|
|
file:
|
|
state: directory
|
|
path: "~/.docker"
|
|
mode: 0700
|
|
- name: Check if docker user configuration exists
|
|
stat:
|
|
path: "~/.docker/config.json"
|
|
register: docker_config_stat
|
|
- name: Load docker user configuration
|
|
when: docker_config_stat.stat.exists
|
|
slurp:
|
|
path: "~/.docker/config.json"
|
|
register: docker_config
|
|
- name: Parse docker user configuration
|
|
when: docker_config_stat.stat.exists
|
|
set_fact:
|
|
docker_config: "{{ docker_config.content | b64decode | from_json }}"
|
|
- name: Set default docker user configuration
|
|
when: not docker_config_stat.stat.exists
|
|
set_fact:
|
|
docker_config:
|
|
auths: {}
|
|
- name: Add registry to docker user configuration
|
|
no_log: true
|
|
vars:
|
|
new_config:
|
|
auths: |
|
|
{
|
|
"{{ intermediate_registry.host | ipwrap }}:{{ intermediate_registry.port }}":
|
|
{"auth": "{{ (intermediate_registry.username + ":" + intermediate_registry.password) | b64encode }}"},
|
|
"127.0.0.1:{{ socat_port }}":
|
|
{"auth": "{{ (buildset_registry.username + ":" + buildset_registry.password) | b64encode }}"},
|
|
}
|
|
set_fact:
|
|
new_docker_config: "{{ docker_config | combine(new_config, recursive=True) }}"
|
|
- name: Save docker user configuration
|
|
copy:
|
|
content: "{{ new_docker_config | to_nice_json }}"
|
|
dest: "~/.docker/config.json"
|
|
mode: 0600
|
|
|
|
# Pull the images
|
|
|
|
# To support usage with both docker and podman, the buildset registry
|
|
# keeps "docker.io" entries un-namespaced, and any other namespaces
|
|
# are namespaced. Therefore, if we see docker.io in the repository
|
|
# name, we strip it here.
|
|
- name: Pull artifacts from intermediate registry
|
|
block:
|
|
- name: Pull artifacts from intermediate registry
|
|
command: >-
|
|
skopeo --insecure-policy copy
|
|
{{ zj_zuul_artifact.url }}
|
|
docker://127.0.0.1:{{ socat_port }}/{{ zj_zuul_artifact.metadata.repository | regex_replace('^docker\.io/(.*)', '\1') }}:{{ zj_zuul_artifact.metadata.tag }}
|
|
retries: 3
|
|
register: result
|
|
until: result is success
|
|
when: "'metadata' in zj_zuul_artifact and zj_zuul_artifact.metadata.type | default('') == 'container_image'"
|
|
loop: "{{ zuul.artifacts | default([]) }}"
|
|
loop_control:
|
|
loop_var: zj_zuul_artifact
|
|
always:
|
|
- name: Remove docker user config
|
|
command: "shred ~/.docker/config.json"
|
|
- name: Replace docker user configuration
|
|
copy:
|
|
content: "{{ docker_config | to_nice_json }}"
|
|
dest: "~/.docker/config.json"
|
|
mode: 0600
|