RHOAIENG-868: Fix Skopeo-copy tekton task to read auth credentials

Sara4994 commented 7 months ago

This PR fixes the Skopeo-copy tekton task to read through the credentials present in dockerconfig, there by allowing authenticate the registries and push the built images to it.

JIRA issue: https://issues.redhat.com/browse/RHOAIENG-868?filter=-1

Description

Modified the Skopeo-copy tekton but adding scripts to read throught dockerconfig files and to fetch the credentials out of it.

How Has This Been Tested?

Following the readme provided mounted all the required kubernetes resources on to the cluster, along with modified tekton task - Skopeo-copy, pipeline and pipelineruns.
Created a quay repository and robot account to access the repository. Downloaded the credentials of the robot account and stored it in file rhoai-edge-build-secret.yml along with credentials of the internal registry where the built image resides.
Mounted this secret file on to the cluster
Started the pipelinerun and the skopeo-copy step passed successfully.

Merge criteria:

[ ] The commits are squashed in a cohesive manner and have meaningful messages.
[ ] Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
[ ] The developer has manually tested the changes and verified that the changes work

openshift-ci-robot commented 7 months ago

@Sara4994: This pull request references RHOAIENG-868 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.16.0" version, but no target version was set.

In response to [this](https://github.com/opendatahub-io/ai-edge/pull/195): > > >## Description > > >## How Has This Been Tested? > > > > >## Merge criteria: > > > >- [ ] The commits are squashed in a cohesive manner and have meaningful messages. >- [ ] Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious). >- [ ] The developer has manually tested the changes and verified that the changes work > Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=opendatahub-io%2Fai-edge). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.

openshift-ci[bot] commented 7 months ago

Skipping CI for Draft Pull Request. If you want CI signal for your change, please convert it to an actual PR. You can still manually trigger a test run with /test all

openshift-ci[bot] commented 7 months ago

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Sara4994 Once this PR has been reviewed and has the lgtm label, please assign lavlas for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files: - **[OWNERS](https://github.com/opendatahub-io/ai-edge/blob/main/OWNERS)** Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment

LaVLaS commented 7 months ago

@Sara4994 Can you update the aiedge-e2e/README.md to document that this enhancement. This change should allow users to use the Quay Robot kubernetes secret directly as the dockerconfig workspace for your skopeo-copy change

openshift-ci-robot commented 7 months ago

@Sara4994: This pull request references RHOAIENG-868 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.16.0" version, but no target version was set.

In response to [this](https://github.com/opendatahub-io/ai-edge/pull/195): > > >This PR fixes the Skopeo-copy tekton task to read through the credentials present in dockerconfig, there by allowing authenticate the registries and push the built images to it. > >JIRA issue: https://issues.redhat.com/browse/RHOAIENG-868?filter=-1 > >## Description >Modified the Skopeo-copy tekton but adding scripts to read throught dockerconfig files and to fetch the credentials out of it. > >## How Has This Been Tested? >- Following the readme provided mounted all the required kubernetes resources on to the cluster, along with modified tekton task - Skopeo-copy, pipeline and pipelineruns. >- Created a quay repository and robot account to access the repository. Downloaded the credentials of the robot account and stored it in file rhoai-edge-build-secret.yml along with credentials of the internal registry where the built image resides. >- Mounted this secret file on to the cluster >- Started the pipelinerun and the skopeo-copy step passed successfully. > >## Merge criteria: > > > >- [ ] The commits are squashed in a cohesive manner and have meaningful messages. >- [ ] Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious). >- [ ] The developer has manually tested the changes and verified that the changes work > Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=opendatahub-io%2Fai-edge). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.

openshift-ci[bot] commented 7 months ago

@Sara4994: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/test-ai-edge	30b28f8772e26db026da186f278d6e625d9931c9	link	true	`/test test-ai-edge`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).

LaVLaS commented 7 months ago

@Sara4994 Can you update the aiedge-e2e pipeline to use this Task and update the parameters for the pipeline and PipelineRun to reference the dockerconfigj

LaVLaS commented 7 months ago

After testing this, I've realized that the initial story I created for this issue was fundamentally flawed to the point that this issue feature will not work as intended because the dockerconfig secret we are mounting to the workspace will not have access to the internal openshift registry. This workflow will only work IF the dockerconfigjson that is provided has auth tokens for the source AND destination registries.

@Sara4994 Given that the feature will not work as intended based on the original story, we can close this PR

opendatahub-io / ai-edge