Migrate Tekton multi-arch image build to ghcr.io

[afrittoli]

Feature request

Migrate the multi-arch-template pipeline to publish to ghcr.io. This includes updates to any of the cronjobs that use this template to build images.

Note: To be implemented as a separate PR: update references in the plumbing repo from gcr.io to ghcr.io once the new images are produced.

The pipeline project release pipeline has been migrated and can provide some insight.

Some key information for the migration:

• Existing path: gcr.io/tekton-releases/dogfooding/<image-name>
• Target path: ghcr.io/tektoncd/plumbing/<image-name>
• GitHub requires OCI labels to be set to associate images with the correct GitHub repo, which should be implemented in #2222

Use case

Reduce Cloud Storage / Container Registry Spending: https://github.com/tektoncd/plumbing/issues/2157

Additional Info

• the template part defines the pipeline that is executed to build images
• the cronjobs provide the trigger for the execution of the pipelines, and they include the list of parameters as well as the frequency of execution

The template part needs to be updated so that it may work with ghcr.io. The current version works with gcr.io, and unfortunately, it's not enough to change the target registry as authentication works a bit different (for gcr.io we used a service account file, and for ghcr.io we use a PAT), and ghcr.io requires OCI labels to be set

There are three types of builds we do today, which correspond to three separate templates.

• Single architecture: https://github.com/tektoncd/plumbing/issues/2221, PLATFORMS and BUILD_TYPE are not set in the cronjob
• Multi-architecture, using docker: https://github.com/tektoncd/plumbing/issues/2223, PLATFORMS is set and BUILD_TYPE=docker
• Multi-architecture, using ko: https://github.com/tektoncd/plumbing/issues/2224, PLATFORMS is set and BUILD_TYPE=ko

This issue covers updating the template and cronjob for multi-architecture, with docker

The order of implementation should be:

• Set the OCI labels in Dockerfiles https://github.com/tektoncd/plumbing/issues/2222
• Adapt the template to work with ghcr.io (see the changes in the pipeline project release pipeline for inspiration)
• Adapt the cronjobs (this can be in the same PR as the template or separate)

[LiteBrick204]

I would like to work on this.

[afrittoli]

@LiteBrick204 that's great, thank you - I assigned you to the issue. Please let me know if you have any question about the contribution process and/or the issue specifically.

[LiteBrick204]

@afrittoli I have done it for the other PRs as well. Need to update the template files alone.

[afrittoli]

Migrate the single-arch-template pipeline to publish to ghcr.io. This includes updates to any of the cronjobs that use this template to build images.

Thank you for the PR! Let me provide you with some more details about this:

• the template defines the pipeline that is executed to build images
• the cronjobs provide the trigger for the execution of the pipelines, and they include the list of parameters as well as the frequency of execution

The template part needs to be updated so that it may work with ghcr.io. The current version works with gcr.io, and unfortunately, it's not enough to change the target registry as authentication works a bit different (for gcr.io we used a service account file, and for ghcr.io we use a PAT), and ghcr.io requires OCI labels to be set

I think the order of implementation should be:

• Set the OCI labels in Dockerfiles https://github.com/tektoncd/plumbing/issues/2222
• Adapt the template to work with ghcr.io (see the changes in the pipeline project release pipeline for inspiration)
• Adapt the cronjobs, that you started in https://github.com/tektoncd/plumbing/pull/2228

One more note on this. There are three types of builds we do today, which correspond to three separate templates:

• Single architecture: #2221, PLATFORMS and BUILD_TYPE are not set in the cronjob
• Multi-architecture, using docker: #2223, PLATFORMS is set and BUILD_TYPE=docker
• Multi-architecture, using ko: #2224, PLATFORMS is set and BUILD_TYPE=ko

[LiteBrick204]

For the EasyCLA, I am waiting for approval. The site is not going through with it.

[LiteBrick204]

The credentials are the same for multi-arch build same as #2221 https://github.com/tektoncd/plumbing/blob/main/tekton/resources/images/docker-multi-arch-template.yaml#L92-L93