Tekton笔记(三)之catalog kaniko

kaniko是一个容器镜像构建工具

本文主要讲述从github获取Dockerfile，构建镜像，最终上传仓库的过程。

本文使用的task版本为：

https://github.com/tektoncd/catalog/tree/main/task/kaniko/0.6

https://github.com/tektoncd/catalog/tree/main/task/git-clone/0.8

准备工作

• 安装tekton，dashboard环境
  具体步骤请按照这篇教程操作：https://tekton.dev/docs/dashboard/tutorial/
• 安装内置task

  kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/git-clone/0.8/git-clone.yaml
  kubectl apply -f https://raw.githubusercontent.com/tektoncd/catalog/main/task/kaniko/0.6/kaniko.yaml
  

设置workspace

为了能在pipeline里有一个储存中间结果的地方，供前后不同的task使用，需要创建一个workspace。

而workspace后端实际上关联的是个pvc。

创建workspace的pvc

# https://raw.githubusercontent.com/tektoncd/catalog/main/task/kaniko/0.6/tests/resources.yaml
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: kaniko-source-pvc
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi

PipelineRun

进入正式部分

# https://raw.githubusercontent.com/tektoncd/catalog/main/task/kaniko/0.6/tests/run.yaml
apiVersion: tekton.dev/v1beta1
kind: PipelineRun
metadata:
  name: kaniko-test-pipeline-run
spec:
  pipelineRef:
    name: kaniko-test-pipeline
  params:
  - name: image
    value: localhost:5000/kaniko-nocode
  workspaces:
  - name: shared-workspace
    persistentvolumeclaim:
      claimName: kaniko-source-pvc

这里有两点注意：

1. image是最后推送到仓库的url
2. workspaces设置绑定了pvc

Pipeline

限于篇幅只介绍部分配置文件

完整请参考https://raw.githubusercontent.com/tektoncd/catalog/main/task/kaniko/0.6/tests/run.yaml

git-clone

[1] 第一处修改是因为git-clone 0.8开始有重大改变，变成了nonroot拉取代码。

Note : The git-clone Task is run as nonroot. The files cloned on to the output workspace will end up owned by user 65532.

所以要做一定修改添加securityContext

[2] 第二处修改用于上传镜像之集群内部的registry

apiVersion: tekton.dev/v1beta1
 kind: PipelineRun
 metadata:
@@ -81,9 +81,12 @@
 spec:
   pipelineRef:
     name: kaniko-test-pipeline
+  podTemplate:						[1]
+    securityContext:
+      fsGroup: 65532
   params:
   - name: image
-    value: localhost:5000/kaniko-nocode		[2]
+    value: docker-registry:5000/kaniko-nocode
   workspaces:
   - name: shared-workspace
     persistentvolumeclaim:

完整信息请查看https://github.com/tektoncd/catalog/tree/main/task/git-clone/0.8

kaniko

如果本地registry只支持http方式，需要设置参数--insecure

  - name: kaniko
    taskRef:
      name: kaniko
    runAfter:
    - fetch-repository
    workspaces:
    - name: source
      workspace: shared-workspace
    params:
    - name: IMAGE
      value: $(params.image)
    - name: EXTRA_ARGS
      value:
        - --skip-tls-verify
        - --insecure

测试运行

部署yaml

# kubectl apply -f run.yaml 
pipeline.tekton.dev/kaniko-test-pipeline created
pipelinerun.tekton.dev/kaniko-test-pipeline-run created

连通内部docker-registry

# kubectl port-forward service/docker-registry 5000:5000

查看registry里是否成功上传镜像，这里可以看到kaniko-nocode已经成功上传

# curl -X GET http://localhost:5000/v2/_catalog
{"repositories":["kaniko-nocode","nginx"]}

支持docker hub仓库

完成了简单内部无密码，无tls仓库上传后。正式仓库肯定是要https，要账户，要密码的。

接下来以docker hub为例

转存docker凭据

1. docker login手动登录产生/root/.docker/config.json

2. 将config.json转化成secret

   # kubectl create secret generic dockerhub-secret --from-file=/root/.docker/config.json
   

3. 在PipelineRun里增加一个dockerconfig-ws的workspace

   apiVersion: tekton.dev/v1beta1
    kind: PipelineRun
    metadata:
   @@ -81,10 +84,16 @@
      workspaces:
      - name: shared-workspace
        persistentvolumeclaim:
          claimName: kaniko-source-pvc
   +  - name: dockerconfig-ws
   +    secret:
   +      secretName: dockerhub-secret
   

4. 修改镜像上传的URL [1]

   apiVersion: tekton.dev/v1beta1
    kind: PipelineRun
    metadata:
   @@ -81,9 +81,12 @@
      params:
      - name: image
   -    value: docker-registry:5000/kaniko-nocode
   +    value: docker.io/massivezh/kaniko-nocode		[1]
   

5. 在Pipeline的一开始workspaces声明新增的dockerconfig-ws

   apiVersion: tekton.dev/v1beta1
   kind: Pipeline
   metadata:
     name: kaniko-test-pipeline
   spec:
     workspaces:
     - name: shared-workspace
     - name: dockerconfig-ws
       optional: true  
   

6. 在kaniko里绑定dockerconfig配置项到dockerconfig-ws这个workspace

     - name: kaniko
       taskRef:
         name: kaniko
       runAfter:
       - fetch-repository
       workspaces:
       - name: source
         workspace: shared-workspace
       - name: dockerconfig
         workspace: dockerconfig-ws
   

   关于dockerconfig的具体用法参考文档https://github.com/tektoncd/catalog/tree/main/task/kaniko/0.6
   具体实现看这里https://github.com/tektoncd/catalog/blob/main/task/kaniko/0.6/kaniko.yaml
   可以看到是mountPath到文件的，关于workspace支持的其他一些类型，请参考workspaces文档

     workspaces:
       - name: source
         description: Holds the context and Dockerfile
       - name: dockerconfig
         description: Includes a docker `config.json`
         optional: true
         mountPath: /kaniko/.docker
   

7. 开启tls验证，去掉--skip-tls-verify

       - name: EXTRA_ARGS
         value:
           - --skip-tls-verify
   

验证结果

最后我们通过dashboard看下运行结果

登录docker hub可以看到镜像已经成功上传