public_git
/
kaniko
mirror of https://github.com/GoogleContainerTools/kaniko
1
0
Fork 0
Code Issues Releases Wiki Activity

Allow setting serviceAccount in integration test 

Previously it would mount .config/gcloud directory which is not
recommended for systems such as CI that authenticate with Google Cloud.
This commit allows you to set the path to a service account.

By default previous behaviour will be as before so this shouldn't break
existing systems that run the integration test.
This commit is contained in:
Sam Stoelinga 2020-01-12 18:26:38 -08:00
parent 464ac134f5
commit 8cf392e20e
3 changed files with 90 additions and 61 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
integration-test.sh
View File

@ -1,5 +1,4 @@
#!/bin/bash #!/bin/bash
# Copyright 2018 Google LLC # Copyright 2018 Google LLC
# #
# Licensed under the Apache License, Version 2.0 (the "License"); # Licensed under the Apache License, Version 2.0 (the "License");
@ -36,5 +35,4 @@ fi
echo "Running integration tests..." echo "Running integration tests..."
make out/executor make out/executor
make out/warmer make out/warmer
pushd integration go test ./integration/... -v --bucket "${GCS_BUCKET}" --repo "${IMAGE_REPO}" --timeout 30m "$@"
go test -v --bucket "${GCS_BUCKET}" --repo "${IMAGE_REPO}" --timeout 30m

69
integration/images.go
View File

@ -140,10 +140,21 @@ func NewDockerFileBuilder(dockerfiles []string) *DockerFileBuilder {
return &d return &d
} }
func addServiceAccountFlags(flags []string, serviceAccount string) []string {
if len(serviceAccount) > 0 {
flags = append(flags, "-e",
"GOOGLE_APPLICATION_CREDENTIALS=/secret/"+filepath.Base(serviceAccount),
"-v", filepath.Dir(serviceAccount)+":/secret/")
} else {
flags = append(flags, "-v", os.Getenv("HOME")+"/.config/gcloud:/root/.config/gcloud")
}
return flags
}
// BuildImage will build dockerfile (located at dockerfilesPath) using both kaniko and docker. // BuildImage will build dockerfile (located at dockerfilesPath) using both kaniko and docker.
// The resulting image will be tagged with imageRepo. If the dockerfile will be built with // The resulting image will be tagged with imageRepo. If the dockerfile will be built with
// context (i.e. it is in `buildContextTests`) the context will be pulled from gcsBucket. // context (i.e. it is in `buildContextTests`) the context will be pulled from gcsBucket.
func (d *DockerFileBuilder) BuildImage(imageRepo, gcsBucket, dockerfilesPath, dockerfile string) error { func (d *DockerFileBuilder) BuildImage(imageRepo, gcsBucket, dockerfilesPath, dockerfile, serviceAccount string) error {
_, ex, _, _ := runtime.Caller(0) _, ex, _, _ := runtime.Caller(0)
cwd := filepath.Dir(ex) cwd := filepath.Dir(ex)
@ -172,6 +183,7 @@ func (d *DockerFileBuilder) BuildImage(imageRepo, gcsBucket, dockerfilesPath, do
if err != nil { if err != nil {
return fmt.Errorf("Failed to build image %s with docker command \"%s\": %s %s", dockerImage, dockerCmd.Args, err, string(out)) return fmt.Errorf("Failed to build image %s with docker command \"%s\": %s %s", dockerImage, dockerCmd.Args, err, string(out))
} }
fmt.Printf("Build image for Dockerfile %s as %s. docker build output: %s \n", dockerfile, dockerImage, out)
contextFlag := "-c" contextFlag := "-c"
contextPath := buildContextPath contextPath := buildContextPath
@ -206,18 +218,22 @@ func (d *DockerFileBuilder) BuildImage(imageRepo, gcsBucket, dockerfilesPath, do
// build kaniko image // build kaniko image
additionalFlags = append(buildArgs, additionalKanikoFlagsMap[dockerfile]...) additionalFlags = append(buildArgs, additionalKanikoFlagsMap[dockerfile]...)
kanikoImage := GetKanikoImage(imageRepo, dockerfile) kanikoImage := GetKanikoImage(imageRepo, dockerfile)
kanikoCmd := exec.Command("docker", fmt.Printf("Going to build image with kaniko: %s, flags: %s \n", kanikoImage, additionalFlags)
append([]string{"run", dockerRunFlags := []string{
"-v", os.Getenv("HOME") + "/.config/gcloud:/root/.config/gcloud", "run", "-e", benchmarkEnv,
"-v", benchmarkDir + ":/kaniko/benchmarks",
"-v", cwd + ":/workspace", "-v", cwd + ":/workspace",
"-e", benchmarkEnv, "-v", benchmarkDir + ":/kaniko/benchmarks",
ExecutorImage, }
dockerRunFlags = addServiceAccountFlags(dockerRunFlags, serviceAccount)
dockerRunFlags = append(dockerRunFlags, ExecutorImage,
"-f", path.Join(buildContextPath, dockerfilesPath, dockerfile), "-f", path.Join(buildContextPath, dockerfilesPath, dockerfile),
"-d", kanikoImage, reproducibleFlag, "-d", kanikoImage, reproducibleFlag,
contextFlag, contextPath}, contextFlag, contextPath)
additionalFlags...)..., dockerRunFlags = append(dockerRunFlags, additionalFlags...)
)
kanikoCmd := exec.Command("docker", dockerRunFlags...)
timer = timing.Start(dockerfile + "_kaniko") timer = timing.Start(dockerfile + "_kaniko")
out, err = RunCommandWithoutTest(kanikoCmd) out, err = RunCommandWithoutTest(kanikoCmd)
@ -235,6 +251,7 @@ func populateVolumeCache() error {
cwd := filepath.Dir(ex) cwd := filepath.Dir(ex)
warmerCmd := exec.Command("docker", warmerCmd := exec.Command("docker",
append([]string{"run", append([]string{"run",
"-d",
"-v", os.Getenv("HOME") + "/.config/gcloud:/root/.config/gcloud", "-v", os.Getenv("HOME") + "/.config/gcloud:/root/.config/gcloud",
"-v", cwd + ":/workspace", "-v", cwd + ":/workspace",
WarmerImage, WarmerImage,
@ -251,7 +268,7 @@ func populateVolumeCache() error {
} }
// buildCachedImages builds the images for testing caching via kaniko where version is the nth time this image has been built // buildCachedImages builds the images for testing caching via kaniko where version is the nth time this image has been built
func (d *DockerFileBuilder) buildCachedImages(imageRepo, cacheRepo, dockerfilesPath string, version int) error { func (d *DockerFileBuilder) buildCachedImages(imageRepo, cacheRepo, dockerfilesPath, serviceAccount string, version int) error {
_, ex, _, _ := runtime.Caller(0) _, ex, _, _ := runtime.Caller(0)
cwd := filepath.Dir(ex) cwd := filepath.Dir(ex)
@ -264,19 +281,19 @@ func (d *DockerFileBuilder) buildCachedImages(imageRepo, cacheRepo, dockerfilesP
benchmarkEnv = "BENCHMARK_FILE=/workspace/benchmarks/" + dockerfile benchmarkEnv = "BENCHMARK_FILE=/workspace/benchmarks/" + dockerfile
} }
kanikoImage := GetVersionedKanikoImage(imageRepo, dockerfile, version) kanikoImage := GetVersionedKanikoImage(imageRepo, dockerfile, version)
kanikoCmd := exec.Command("docker",
append([]string{"run", dockerRunFlags := []string{"run",
"-v", os.Getenv("HOME") + "/.config/gcloud:/root/.config/gcloud",
"-v", cwd + ":/workspace", "-v", cwd + ":/workspace",
"-e", benchmarkEnv, "-e", benchmarkEnv}
ExecutorImage, dockerRunFlags = addServiceAccountFlags(dockerRunFlags, serviceAccount)
dockerRunFlags = append(dockerRunFlags, ExecutorImage,
"-f", path.Join(buildContextPath, dockerfilesPath, dockerfile), "-f", path.Join(buildContextPath, dockerfilesPath, dockerfile),
"-d", kanikoImage, "-d", kanikoImage,
"-c", buildContextPath, "-c", buildContextPath,
cacheFlag, cacheFlag,
"--cache-repo", cacheRepo, "--cache-repo", cacheRepo,
"--cache-dir", cacheDir})..., "--cache-dir", cacheDir)
) kanikoCmd := exec.Command("docker", dockerRunFlags...)
timer := timing.Start(dockerfile + "_kaniko_cached_" + strconv.Itoa(version)) timer := timing.Start(dockerfile + "_kaniko_cached_" + strconv.Itoa(version))
_, err := RunCommandWithoutTest(kanikoCmd) _, err := RunCommandWithoutTest(kanikoCmd)
@ -289,24 +306,22 @@ func (d *DockerFileBuilder) buildCachedImages(imageRepo, cacheRepo, dockerfilesP
} }
// buildRelativePathsImage builds the images for testing passing relatives paths to Kaniko // buildRelativePathsImage builds the images for testing passing relatives paths to Kaniko
func (d *DockerFileBuilder) buildRelativePathsImage(imageRepo, dockerfile string) error { func (d *DockerFileBuilder) buildRelativePathsImage(imageRepo, dockerfile, serviceAccount string) error {
_, ex, _, _ := runtime.Caller(0) _, ex, _, _ := runtime.Caller(0)
cwd := filepath.Dir(ex) cwd := filepath.Dir(ex)
buildContextPath := "./relative-subdirectory" buildContextPath := "./relative-subdirectory"
kanikoImage := GetKanikoImage(imageRepo, dockerfile) kanikoImage := GetKanikoImage(imageRepo, dockerfile)
kanikoCmd := exec.Command("docker", dockerRunFlags := []string{"run", "-v", cwd + ":/workspace"}
append([]string{"run", dockerRunFlags = addServiceAccountFlags(dockerRunFlags, serviceAccount)
"-v", os.Getenv("HOME") + "/.config/gcloud:/root/.config/gcloud", dockerRunFlags = append(dockerRunFlags, ExecutorImage,
"-v", cwd + ":/workspace",
ExecutorImage,
"-f", dockerfile, "-f", dockerfile,
"-d", kanikoImage, "-d", kanikoImage,
"--digest-file", "./digest", "--digest-file", "./digest",
"-c", buildContextPath, "-c", buildContextPath)
})...,
) kanikoCmd := exec.Command("docker", dockerRunFlags...)
timer := timing.Start(dockerfile + "_kaniko_relative_paths") timer := timing.Start(dockerfile + "_kaniko_relative_paths")
_, err := RunCommandWithoutTest(kanikoCmd) _, err := RunCommandWithoutTest(kanikoCmd)

46
integration/integration_test.go
View File

@ -200,13 +200,14 @@ func TestGitBuildcontext(t *testing.T) {
// Build with kaniko // Build with kaniko
kanikoImage := GetKanikoImage(config.imageRepo, "Dockerfile_test_git") kanikoImage := GetKanikoImage(config.imageRepo, "Dockerfile_test_git")
kanikoCmd := exec.Command("docker", dockerRunFlags := []string{"run"}
append([]string{"run", dockerRunFlags = addServiceAccountFlags(dockerRunFlags, config.serviceAccount)
"-v", os.Getenv("HOME") + "/.config/gcloud:/root/.config/gcloud", dockerRunFlags = append(dockerRunFlags, ExecutorImage,
ExecutorImage,
"-f", dockerfile, "-f", dockerfile,
"-d", kanikoImage, "-d", kanikoImage,
"-c", fmt.Sprintf("git://%s", repo)})...) "-c", fmt.Sprintf("git://%s", repo))
kanikoCmd := exec.Command("docker", dockerRunFlags...)
out, err = RunCommandWithoutTest(kanikoCmd) out, err = RunCommandWithoutTest(kanikoCmd)
if err != nil { if err != nil {
@ -243,13 +244,14 @@ func TestGitBuildContextWithBranch(t *testing.T) {
// Build with kaniko // Build with kaniko
kanikoImage := GetKanikoImage(config.imageRepo, "Dockerfile_test_git") kanikoImage := GetKanikoImage(config.imageRepo, "Dockerfile_test_git")
kanikoCmd := exec.Command("docker", dockerRunFlags := []string{"run"}
append([]string{"run", dockerRunFlags = addServiceAccountFlags(dockerRunFlags, config.serviceAccount)
"-v", os.Getenv("HOME") + "/.config/gcloud:/root/.config/gcloud", dockerRunFlags = append(dockerRunFlags, ExecutorImage,
ExecutorImage,
"-f", dockerfile, "-f", dockerfile,
"-d", kanikoImage, "-d", kanikoImage,
"-c", fmt.Sprintf("git://%s", repo)})...) "-c", fmt.Sprintf("git://%s", repo))
kanikoCmd := exec.Command("docker", dockerRunFlags...)
out, err = RunCommandWithoutTest(kanikoCmd) out, err = RunCommandWithoutTest(kanikoCmd)
if err != nil { if err != nil {
@ -306,7 +308,7 @@ func buildImage(t *testing.T, dockerfile string, imageBuilder *DockerFileBuilder
} }
if err := imageBuilder.BuildImage( if err := imageBuilder.BuildImage(
config.imageRepo, config.gcsBucket, dockerfilesPath, dockerfile, config.imageRepo, config.gcsBucket, dockerfilesPath, dockerfile, config.serviceAccount,
); err != nil { ); err != nil {
t.Errorf("Error building image: %s", err) t.Errorf("Error building image: %s", err)
t.FailNow() t.FailNow()
@ -324,11 +326,11 @@ func TestCache(t *testing.T) {
t.Parallel() t.Parallel()
cache := filepath.Join(config.imageRepo, "cache", fmt.Sprintf("%v", time.Now().UnixNano())) cache := filepath.Join(config.imageRepo, "cache", fmt.Sprintf("%v", time.Now().UnixNano()))
// Build the initial image which will cache layers // Build the initial image which will cache layers
if err := imageBuilder.buildCachedImages(config.imageRepo, cache, dockerfilesPath, 0); err != nil { if err := imageBuilder.buildCachedImages(config.imageRepo, cache, dockerfilesPath, config.serviceAccount, 0); err != nil {
t.Fatalf("error building cached image for the first time: %v", err) t.Fatalf("error building cached image for the first time: %v", err)
} }
// Build the second image which should pull from the cache // Build the second image which should pull from the cache
if err := imageBuilder.buildCachedImages(config.imageRepo, cache, dockerfilesPath, 1); err != nil { if err := imageBuilder.buildCachedImages(config.imageRepo, cache, dockerfilesPath, config.serviceAccount, 1); err != nil {
t.Fatalf("error building cached image for the first time: %v", err) t.Fatalf("error building cached image for the first time: %v", err)
} }
// Make sure both images are the same // Make sure both images are the same
@ -359,7 +361,7 @@ func TestRelativePaths(t *testing.T) {
t.Run("test_relative_"+dockerfile, func(t *testing.T) { t.Run("test_relative_"+dockerfile, func(t *testing.T) {
t.Parallel() t.Parallel()
imageBuilder.buildRelativePathsImage(config.imageRepo, dockerfile) imageBuilder.buildRelativePathsImage(config.imageRepo, dockerfile, config.serviceAccount)
dockerImage := GetDockerImage(config.imageRepo, dockerfile) dockerImage := GetDockerImage(config.imageRepo, dockerfile)
kanikoImage := GetKanikoImage(config.imageRepo, dockerfile) kanikoImage := GetKanikoImage(config.imageRepo, dockerfile)
@ -495,6 +497,7 @@ type gcpConfig struct {
imageRepo string imageRepo string
onbuildBaseImage string onbuildBaseImage string
hardlinkBaseImage string hardlinkBaseImage string
serviceAccount string
} }
type imageDetails struct { type imageDetails struct {
@ -510,9 +513,22 @@ func (i imageDetails) String() string {
func initGCPConfig() *gcpConfig { func initGCPConfig() *gcpConfig {
var c gcpConfig var c gcpConfig
flag.StringVar(&c.gcsBucket, "bucket", "gs://kaniko-test-bucket", "The gcs bucket argument to uploaded the tar-ed contents of the `integration` dir to.") flag.StringVar(&c.gcsBucket, "bucket", "gs://kaniko-test-bucket", "The gcs bucket argument to uploaded the tar-ed contents of the `integration` dir to.")
flag.StringVar(&c.imageRepo, "repo", "gcr.io/kaniko-test", "The (docker) image repo to build and push images to during the test. `gcloud` must be authenticated with this repo.") flag.StringVar(&c.imageRepo, "repo", "gcr.io/kaniko-test", "The (docker) image repo to build and push images to during the test. `gcloud` must be authenticated with this repo or serviceAccount must be set.")
flag.StringVar(&c.serviceAccount, "serviceAccount", "", "The path to the service account push images to GCR and upload/download files to GCS.")
flag.Parse() flag.Parse()
if len(c.serviceAccount) > 0 {
absPath, err := filepath.Abs("../" + c.serviceAccount)
if err != nil {
log.Fatalf("Error getting absolute path for service account: %s\n", c.serviceAccount)
}
if _, err := os.Stat(absPath); os.IsNotExist(err) {
log.Fatalf("Service account does not exist: %s\n", absPath)
}
c.serviceAccount = absPath
os.Setenv("GOOGLE_APPLICATION_CREDENTIALS", absPath)
}
if c.gcsBucket == "" || c.imageRepo == "" { if c.gcsBucket == "" || c.imageRepo == "" {
log.Fatalf("You must provide a gcs bucket (\"%s\" was provided) and a docker repo (\"%s\" was provided)", c.gcsBucket, c.imageRepo) log.Fatalf("You must provide a gcs bucket (\"%s\" was provided) and a docker repo (\"%s\" was provided)", c.gcsBucket, c.imageRepo)
} }