74215c43e7
Buildx image building (for multiarch support) requires us to set up CA certificates that are trusted by the image for access to the registr(y|ies). The buildx image switched to alpine at some point which doesn't include the update-ca-certificates command we were depending on for this by default. Install that package so that we can update-ca-certificates and trust the registr(y|ies). Note that there may be a better way via buildkitd.toml configuration files that allow us to configure certs upfront and have the image set them up for us. This is documented in a todo as a future action we can investigate. Change-Id: Ied0b8e81ed6a7a15ea2def26b85b933223cb42e6
107 lines
4.5 KiB
YAML
107 lines
4.5 KiB
YAML
- name: Update qemu-static container settings
|
|
command: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
|
|
environment:
|
|
DOCKER_CLI_EXPERIMENTAL: enabled
|
|
when: ansible_architecture == 'x86_64'
|
|
|
|
# TODO(clarkb) Use buildkitd.toml configuration to add certifications. That
|
|
# may allow us to drop the ca-certificates install and update-ca-certificates
|
|
# step below. More info here:
|
|
# https://docs.docker.com/reference/cli/docker/buildx/create/#buildkitd-config
|
|
- name: Create builder
|
|
command: "docker buildx create --name mybuilder --node {{ inventory_hostname | replace('-', '_') }} --driver-opt network=host{% if buildset_registry is defined %} --config /etc/buildkit/buildkitd.toml {% endif %}"
|
|
environment:
|
|
DOCKER_CLI_EXPERIMENTAL: enabled
|
|
when: inventory_hostname == ansible_play_hosts[0]
|
|
|
|
- name: Add host key to known_hosts
|
|
shell: "ssh-keyscan -H {{ ansible_host }} >> ~/.ssh/known_hosts"
|
|
when: inventory_hostname != ansible_play_hosts[0]
|
|
delegate_to: "{{ ansible_play_hosts[0] }}"
|
|
|
|
- name: Append builders from other nodes
|
|
command: "docker buildx create --append --name mybuilder --node {{ inventory_hostname | replace('-', '_') }} --driver-opt network=host{% if buildset_registry is defined %} --config /etc/buildkit/buildkitd.toml {% endif %} ssh://{{ ansible_user }}@{{ ansible_host }}"
|
|
environment:
|
|
DOCKER_CLI_EXPERIMENTAL: enabled
|
|
when: inventory_hostname != ansible_play_hosts[0]
|
|
delegate_to: "{{ ansible_play_hosts[0] }}"
|
|
|
|
- name: Use builder
|
|
command: docker buildx use mybuilder
|
|
environment:
|
|
DOCKER_CLI_EXPERIMENTAL: enabled
|
|
when: inventory_hostname == ansible_play_hosts[0]
|
|
|
|
- name: Bootstrap builder
|
|
command: docker buildx inspect --bootstrap
|
|
environment:
|
|
DOCKER_CLI_EXPERIMENTAL: enabled
|
|
when: inventory_hostname == ansible_play_hosts[0]
|
|
|
|
- name: Make tempfile for registry TLS certificate
|
|
tempfile:
|
|
state: file
|
|
register: buildkit_cert_tmp
|
|
|
|
- name: Write buildset registry TLS certificate
|
|
become: true
|
|
copy:
|
|
content: "{{ buildset_registry.cert }}"
|
|
dest: "{{ buildkit_cert_tmp.path }}"
|
|
mode: preserve
|
|
when: buildset_registry is defined and buildset_registry.cert
|
|
|
|
- name: Install CA certs in worker container
|
|
command: "docker exec buildx_buildkit_{{ inventory_hostname | replace('-', '_') }} apk add --no-cache ca-certificates"
|
|
when: buildset_registry is defined and buildset_registry.cert
|
|
|
|
- name: Copy buildset registry TLS cert into worker container
|
|
command: "docker cp {{ buildkit_cert_tmp.path }} buildx_buildkit_{{ inventory_hostname | replace('-', '_') }}:/usr/local/share/ca-certificates"
|
|
when: buildset_registry is defined and buildset_registry.cert
|
|
|
|
- name: Update CA certs in worker container
|
|
command: "docker exec buildx_buildkit_{{ inventory_hostname | replace('-', '_') }} update-ca-certificates"
|
|
when: buildset_registry is defined and buildset_registry.cert
|
|
|
|
- name: Remove TLS cert tempfile
|
|
file:
|
|
state: absent
|
|
path: '{{ buildkit_cert_tmp.path }}'
|
|
when: buildset_registry is defined and buildset_registry.cert
|
|
|
|
- name: Make tempfile for /etc/hosts
|
|
tempfile:
|
|
state: file
|
|
register: etc_hosts_tmp
|
|
|
|
- name: Copy /etc/hosts for editing
|
|
command: "docker cp buildx_buildkit_{{ inventory_hostname | replace('-', '_') }}:/etc/hosts {{ etc_hosts_tmp.path }}"
|
|
|
|
# Docker buildx has its own /etc/hosts in the builder image.
|
|
- name: Configure /etc/hosts for buildset_registry to workaround docker not understanding ipv6 addresses
|
|
become: yes
|
|
lineinfile:
|
|
path: '{{ etc_hosts_tmp.path }}'
|
|
state: present
|
|
regex: "^{{ buildset_registry.host }}\tzuul-jobs.buildset-registry$"
|
|
line: "{{ buildset_registry.host }}\tzuul-jobs.buildset-registry"
|
|
insertafter: EOF
|
|
when: buildset_registry is defined and buildset_registry.host | ipaddr
|
|
|
|
- name: Unmount the /etc/hosts mount
|
|
command: "docker exec buildx_buildkit_{{ inventory_hostname | replace('-', '_') }} umount /etc/hosts"
|
|
|
|
# NOTE(mordred) This is done in two steps. Even though we've unmounted /etc/hosts
|
|
# in the previous step, when we try to copy the file back directly, we get:
|
|
# unlinkat /etc/hosts: device or resource busy
|
|
- name: Copy modified hosts file back in
|
|
command: "docker cp {{ etc_hosts_tmp.path }} buildx_buildkit_{{ inventory_hostname | replace('-', '_') }}:/etc/new-hosts"
|
|
|
|
- name: Copy modified hosts file into place
|
|
command: "docker exec buildx_buildkit_{{ inventory_hostname | replace('-', '_') }} cp /etc/new-hosts /etc/hosts"
|
|
|
|
- name: Remove tempfile for /etc/hosts
|
|
file:
|
|
state: absent
|
|
path: '{{ etc_hosts_tmp.path }}'
|