From 1350ffdf9229807cfd6553524168b908b00a48f7 Mon Sep 17 00:00:00 2001 From: Tom Alexander Date: Wed, 21 Oct 2026 09:38:34 -0400 Subject: [PATCH] Switch from buildkit to buildah. BuildKit caching is not working but buildah caching works perfectly. --- .webhook_bridge/pipeline-build-hash.yaml | 92 ++++++++++++++----- .webhook_bridge/pipeline-format.yaml | 107 +++++++++++----------- .webhook_bridge/pipeline-rust-clippy.yaml | 56 ++++++----- .webhook_bridge/pipeline-rust-test.yaml | 52 ++++++----- 4 files changed, 188 insertions(+), 119 deletions(-) diff --git a/.webhook_bridge/pipeline-build-hash.yaml b/.webhook_bridge/pipeline-build-hash.yaml index 4e36e55..2c2504b 100644 --- a/.webhook_bridge/pipeline-build-hash.yaml +++ b/.webhook_bridge/pipeline-build-hash.yaml @@ -7,7 +7,7 @@ metadata: spec: timeouts: pipeline: "2h0m0s" - tasks: "1h0m0s" + tasks: "1h0m40s" finally: "0h30m0s" taskRunTemplate: serviceAccountName: build-bot @@ -103,37 +103,43 @@ spec: - name: url value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git - name: revision - value: dda7b690195b43e8b9859d1caf5dcbf48588ade1 + value: 9c6d3bc418dc2f54d73bdfa984bce3eb6c65fd60 - name: pathInRepo - value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml + value: task/buildah-rootless-daemonless/0.1/buildah-rootless-daemonless.yaml params: - name: OUTPUT value: >- - type=image,"name=$(params.image-name):latest,$(params.image-name):$(tasks.fetch-repository.results.commit)",push=true,compression=zstd,compression-level=22,oci-mediatypes=true + $(params.image-name):$(tasks.fetch-repository.results.commit) - name: CONTEXT value: $(params.path-to-image-context) - name: DOCKERFILE value: $(params.path-to-dockerfile) - name: EXTRA_ARGS value: - - "--opt" - - "target=$(params.target-name)" - - --import-cache - - "type=registry,ref=$(params.image-name):buildcache" - - --export-cache - - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true" - - --opt - - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time) - - --opt - - "build-arg:NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org" - - name: BUILDKITD_TOML + - "--target" + - "$(params.target-name)" + - --cache-from + - "$(params.image-name)-buildcache" + - --cache-to + - "$(params.image-name)-buildcache" + - --build-arg + - "SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)" + - --build-arg + - "NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org" + - name: REGISTRIES_CONF value: | - debug = true - [registry."docker.io"] - mirrors = ["dockerhub.dockerhub.svc.cluster.local"] - [registry."dockerhub.dockerhub.svc.cluster.local"] - http = true - insecure = true + unqualified-search-registries = ["docker.io"] + + [[registry]] + location = "dockerhub.dockerhub.svc.cluster.local" + insecure = true + + [[registry]] + location = "docker.io" + + [[registry.mirror]] + location = "dockerhub.dockerhub.svc.cluster.local" # Replace with your mirror URL + insecure = true workspaces: - name: source workspace: git-source @@ -200,9 +206,48 @@ spec: value: failure - name: TARGET_URL value: "https://tekton.fizz.buzz/#/namespaces/$(context.pipelineRun.namespace)/pipelineruns/$(context.pipelineRun.name)" + - name: cargo-cache-autoclean + taskSpec: + metadata: {} + params: + - name: docker-image + type: string + description: Docker image to run. + default: alpine:3.20 + stepTemplate: + image: alpine:3.20 + computeResources: + requests: + cpu: 10m + memory: 600Mi + workingDir: /workspace/source + workspaces: + - name: source + mountPath: /source + - name: cargo-cache + mountPath: /usr/local/cargo/registry + optional: true + steps: + - name: run + image: $(params.docker-image) + workingDir: "$(workspaces.source.path)" + command: [cargo, cache, --autoclean] + args: [] + env: + - name: RUSTUP_PERMIT_COPY_RENAME + value: "true" + workspaces: + - name: source + workspace: git-source + - name: cargo-cache + workspace: cargo-cache + params: + - name: docker-image + value: "$(tasks.build-image.results.IMAGE_URL[0])" workspaces: - name: git-source - name: docker-credentials + - name: cargo-cache workspaces: - name: git-source volumeClaimTemplate: @@ -214,6 +259,9 @@ spec: requests: storage: 10Gi subPath: rust-source + - name: cargo-cache + persistentVolumeClaim: + claimName: natter-cargo-cache-build - name: docker-credentials secret: secretName: harbor-plain @@ -225,4 +273,4 @@ spec: - name: path-to-image-context value: . - name: path-to-dockerfile - value: docker/natter/ + value: docker/natter/Dockerfile diff --git a/.webhook_bridge/pipeline-format.yaml b/.webhook_bridge/pipeline-format.yaml index 0f0ba54..c62d57d 100644 --- a/.webhook_bridge/pipeline-format.yaml +++ b/.webhook_bridge/pipeline-format.yaml @@ -7,7 +7,7 @@ metadata: spec: timeouts: pipeline: "2h0m0s" - tasks: "1h0m0s" + tasks: "1h0m40s" finally: "0h30m0s" taskRunTemplate: serviceAccountName: build-bot @@ -103,35 +103,43 @@ spec: - name: url value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git - name: revision - value: dda7b690195b43e8b9859d1caf5dcbf48588ade1 + value: 9c6d3bc418dc2f54d73bdfa984bce3eb6c65fd60 - name: pathInRepo - value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml + value: task/buildah-rootless-daemonless/0.1/buildah-rootless-daemonless.yaml params: - name: OUTPUT value: >- - type=image,"name=$(params.image-name):latest,$(params.image-name):$(tasks.fetch-repository.results.commit)",push=true,compression=zstd,compression-level=22,oci-mediatypes=true + $(params.image-name):$(tasks.fetch-repository.results.commit) - name: CONTEXT value: $(params.path-to-image-context) - name: DOCKERFILE value: $(params.path-to-dockerfile) - name: EXTRA_ARGS value: - - "--opt" - - "target=$(params.target-name)" - - --import-cache - - "type=registry,ref=$(params.image-name):buildcache" - - --export-cache - - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true" - - --opt - - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time) - - name: BUILDKITD_TOML + - "--target" + - "$(params.target-name)" + - --cache-from + - "$(params.image-name)-buildcache" + - --cache-to + - "$(params.image-name)-buildcache" + - --build-arg + - "SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)" + - --build-arg + - "NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org" + - name: REGISTRIES_CONF value: | - debug = true - [registry."docker.io"] - mirrors = ["dockerhub.dockerhub.svc.cluster.local"] - [registry."dockerhub.dockerhub.svc.cluster.local"] - http = true - insecure = true + unqualified-search-registries = ["docker.io"] + + [[registry]] + location = "dockerhub.dockerhub.svc.cluster.local" + insecure = true + + [[registry]] + location = "docker.io" + + [[registry.mirror]] + location = "dockerhub.dockerhub.svc.cluster.local" # Replace with your mirror URL + insecure = true workspaces: - name: source workspace: git-source @@ -180,7 +188,7 @@ spec: - build-image params: - name: docker-image - value: "$(tasks.build-image.results.IMAGE_URL[1])" + value: "$(tasks.build-image.results.IMAGE_URL[0])" - name: run-prettier taskSpec: metadata: {} @@ -214,36 +222,33 @@ spec: - build-image params: - name: docker-image - value: "$(tasks.build-image.results.IMAGE_URL[1])" + value: "$(tasks.build-image.results.IMAGE_URL[0])" - name: commit-changes - taskSpec: - metadata: {} - stepTemplate: - image: alpine:3.20 - computeResources: - requests: - cpu: 10m - memory: 600Mi - workingDir: "$(workspaces.source.path)" - steps: - - image: alpine/git:v2.34.2 - name: commit-changes-step - script: | - #!/usr/bin/env sh - set -euo pipefail - git config --global user.email "fluxcdbot@users.noreply.github.com" - git config --global user.name "fluxcdbot" - git config --global --add safe.directory /workspace/source - git_status=$(git status --porcelain) - if [ -n "$git_status" ]; then - git commit -a -m "CI: autofix rust code." - git push origin HEAD:$(params.PULL_BASE_REF) - else - echo "No changes to commit." - fi - env: - - name: "GIT_SSH_COMMAND" - value: "ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" + taskRef: + resolver: git + params: + - name: url + value: https://code.fizz.buzz/mirror/catalog.git # mirror of https://github.com/tektoncd/catalog.git + - name: revision + value: df36b3853a5657fd883015cdbf07ad6466918acf + - name: pathInRepo + value: task/git-cli/0.4/git-cli.yaml + params: + - name: GIT_USER_NAME + value: fluxcdbot + - name: GIT_USER_EMAIL + value: "fluxcdbot@users.noreply.github.com" + - name: GIT_SCRIPT + value: | + pwd + git config --global --add safe.directory /workspace/source + git_status=$(git status --porcelain) + if [ -n "$git_status" ]; then + git commit -a -m "CI: autofix rust code." + git push origin HEAD:$(params.PULL_BASE_REF) + else + echo "No changes to commit." + fi workspaces: - name: source workspace: git-source @@ -346,7 +351,7 @@ spec: workspace: cargo-cache params: - name: docker-image - value: "$(tasks.build-image.results.IMAGE_URL[1])" + value: "$(tasks.build-image.results.IMAGE_URL[0])" workspaces: - name: git-source - name: docker-credentials @@ -376,4 +381,4 @@ spec: - name: path-to-image-context value: docker/natter_development/ - name: path-to-dockerfile - value: docker/natter_development/ + value: docker/natter_development/Dockerfile diff --git a/.webhook_bridge/pipeline-rust-clippy.yaml b/.webhook_bridge/pipeline-rust-clippy.yaml index a13460f..d2e9dae 100644 --- a/.webhook_bridge/pipeline-rust-clippy.yaml +++ b/.webhook_bridge/pipeline-rust-clippy.yaml @@ -5,12 +5,12 @@ metadata: labels: pdb: protect spec: - taskRunTemplate: - serviceAccountName: build-bot timeouts: pipeline: "2h0m0s" tasks: "1h0m40s" finally: "0h30m0s" + taskRunTemplate: + serviceAccountName: build-bot pipelineSpec: params: - name: image-name @@ -103,35 +103,43 @@ spec: - name: url value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git - name: revision - value: dda7b690195b43e8b9859d1caf5dcbf48588ade1 + value: 9c6d3bc418dc2f54d73bdfa984bce3eb6c65fd60 - name: pathInRepo - value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml + value: task/buildah-rootless-daemonless/0.1/buildah-rootless-daemonless.yaml params: - name: OUTPUT value: >- - type=image,"name=$(params.image-name):latest,$(params.image-name):$(tasks.fetch-repository.results.commit)",push=true,compression=zstd,compression-level=22,oci-mediatypes=true + $(params.image-name):$(tasks.fetch-repository.results.commit) - name: CONTEXT value: $(params.path-to-image-context) - name: DOCKERFILE value: $(params.path-to-dockerfile) - name: EXTRA_ARGS value: - - "--opt" - - "target=$(params.target-name)" - - --import-cache - - "type=registry,ref=$(params.image-name):buildcache" - - --export-cache - - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true" - - --opt - - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time) - - name: BUILDKITD_TOML + - "--target" + - "$(params.target-name)" + - --cache-from + - "$(params.image-name)-buildcache" + - --cache-to + - "$(params.image-name)-buildcache" + - --build-arg + - "SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)" + - --build-arg + - "NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org" + - name: REGISTRIES_CONF value: | - debug = true - [registry."docker.io"] - mirrors = ["dockerhub.dockerhub.svc.cluster.local"] - [registry."dockerhub.dockerhub.svc.cluster.local"] - http = true - insecure = true + unqualified-search-registries = ["docker.io"] + + [[registry]] + location = "dockerhub.dockerhub.svc.cluster.local" + insecure = true + + [[registry]] + location = "docker.io" + + [[registry.mirror]] + location = "dockerhub.dockerhub.svc.cluster.local" # Replace with your mirror URL + insecure = true workspaces: - name: source workspace: git-source @@ -139,7 +147,7 @@ spec: workspace: docker-credentials runAfter: - fetch-repository - - name: run-cargo-clippy + - name: run-test taskSpec: metadata: {} params: @@ -190,7 +198,7 @@ spec: - build-image params: - name: docker-image - value: "$(tasks.build-image.results.IMAGE_URL[1])" + value: "$(tasks.build-image.results.IMAGE_URL[0])" finally: - name: report-success when: @@ -287,7 +295,7 @@ spec: workspace: cargo-cache params: - name: docker-image - value: "$(tasks.build-image.results.IMAGE_URL[1])" + value: "$(tasks.build-image.results.IMAGE_URL[0])" workspaces: - name: git-source - name: docker-credentials @@ -317,4 +325,4 @@ spec: - name: path-to-image-context value: docker/natter_development/ - name: path-to-dockerfile - value: docker/natter_development/ + value: docker/natter_development/Dockerfile diff --git a/.webhook_bridge/pipeline-rust-test.yaml b/.webhook_bridge/pipeline-rust-test.yaml index 7c0303c..77bfdf4 100644 --- a/.webhook_bridge/pipeline-rust-test.yaml +++ b/.webhook_bridge/pipeline-rust-test.yaml @@ -103,35 +103,43 @@ spec: - name: url value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git - name: revision - value: dda7b690195b43e8b9859d1caf5dcbf48588ade1 + value: 9c6d3bc418dc2f54d73bdfa984bce3eb6c65fd60 - name: pathInRepo - value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml + value: task/buildah-rootless-daemonless/0.1/buildah-rootless-daemonless.yaml params: - name: OUTPUT value: >- - type=image,"name=$(params.image-name):latest,$(params.image-name):$(tasks.fetch-repository.results.commit)",push=true,compression=zstd,compression-level=22,oci-mediatypes=true + $(params.image-name):$(tasks.fetch-repository.results.commit) - name: CONTEXT value: $(params.path-to-image-context) - name: DOCKERFILE value: $(params.path-to-dockerfile) - name: EXTRA_ARGS value: - - "--opt" - - "target=$(params.target-name)" - - --import-cache - - "type=registry,ref=$(params.image-name):buildcache" - - --export-cache - - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true" - - --opt - - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time) - - name: BUILDKITD_TOML + - "--target" + - "$(params.target-name)" + - --cache-from + - "$(params.image-name)-buildcache" + - --cache-to + - "$(params.image-name)-buildcache" + - --build-arg + - "SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)" + - --build-arg + - "NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org" + - name: REGISTRIES_CONF value: | - debug = true - [registry."docker.io"] - mirrors = ["dockerhub.dockerhub.svc.cluster.local"] - [registry."dockerhub.dockerhub.svc.cluster.local"] - http = true - insecure = true + unqualified-search-registries = ["docker.io"] + + [[registry]] + location = "dockerhub.dockerhub.svc.cluster.local" + insecure = true + + [[registry]] + location = "docker.io" + + [[registry.mirror]] + location = "dockerhub.dockerhub.svc.cluster.local" # Replace with your mirror URL + insecure = true workspaces: - name: source workspace: git-source @@ -139,7 +147,7 @@ spec: workspace: docker-credentials runAfter: - fetch-repository - - name: run-cargo-test + - name: run-test taskSpec: metadata: {} params: @@ -180,7 +188,7 @@ spec: - build-image params: - name: docker-image - value: "$(tasks.build-image.results.IMAGE_URL[1])" + value: "$(tasks.build-image.results.IMAGE_URL[0])" finally: - name: report-success when: @@ -277,7 +285,7 @@ spec: workspace: cargo-cache params: - name: docker-image - value: "$(tasks.build-image.results.IMAGE_URL[1])" + value: "$(tasks.build-image.results.IMAGE_URL[0])" workspaces: - name: git-source - name: docker-credentials @@ -307,4 +315,4 @@ spec: - name: path-to-image-context value: docker/natter_development/ - name: path-to-dockerfile - value: docker/natter_development/ + value: docker/natter_development/Dockerfile