mirror of
https://github.com/quay/quay.git
synced 2025-04-18 10:44:06 +03:00
acbe6c2278
When deploying Quay in a Secure AWS environment, we can't use IAM Access Keys or Secrets since these credentials are often blocked for multiple reasons (credentials are long-lived, can be shared / stolen, etc.). So the preferred deployment method is to use an alternative method, like the Web Identity Token files that are automatically created in a Kubernetes cluster that has a federation link with IAM using the OIDC provider federation. The current code of Quay force the use of an IAM account that is then used to assume another role that has S3 access to store the image files. The current pull request removes the need to use that IAM account and allows to directly assume the correct role using Web Identity Tokens while retaining compatibility with the old method of using IAM credentials. The code relies on the automatic detection of the correct configurations using environment variables where possible. The code has been tested on an OpenShift cluster deployed using manual mode with AWS STS.
39 lines
790 B
Bash
Executable File
39 lines
790 B
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -e
|
|
|
|
if [[ -n "$(git status --porcelain)" ]]; then
|
|
echo 'dirty build not supported' >&2
|
|
exit 1
|
|
fi
|
|
|
|
# get named head (ex: branch, tag, etc..)
|
|
NAME="$( git rev-parse --abbrev-ref HEAD )"
|
|
|
|
# get 7-character sha
|
|
SHA=$( git rev-parse --short HEAD )
|
|
|
|
# checkout commit so .git/HEAD points to full sha (used in Dockerfile)
|
|
git checkout $SHA
|
|
|
|
REPO=quay.io/quay/quay:$SHA
|
|
|
|
# Use buildah, podman or docker
|
|
if [ -x /usr/bin/buildah ]; then
|
|
BUILDER="/usr/bin/buildah bud"
|
|
elif [ -x /usr/bin/podman ]; then
|
|
BUILDER="/usr/bin/podman build"
|
|
elif [ -x /usr/bin/docker ] ; then
|
|
BUILDER="/usr/bin/docker build"
|
|
fi
|
|
if [[ -z "$BUILDER" ]]; then
|
|
echo 'Unable to find buildah, podman or docker' >&2
|
|
exit 1
|
|
fi
|
|
echo $BUILDER
|
|
|
|
$BUILDER -t $REPO .
|
|
echo $REPO
|
|
|
|
git checkout "$NAME"
|