Enable skopeo for container releases

- Adds option that enables container copies with skopeo
  instead of pull the image, re-tag, and then push it
- Retains current pull/re-tag/push behavior as default

Related https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/5673

Signed-off-by: Balasankar 'Balu' C <[email protected]>

Author: balasankarc

lib/gitlab/build/gitlab_image.rb

@@ -12,5 +12,9 @@ def self.dockerhub_image_name
     def self.gitlab_registry_image_name
       Build::Info::Package.name
     end
+
+    def self.source_image_address
+      gitlab_registry_image_address(tag: Build::Info::Docker.tag)
+    end
   end
 end

lib/gitlab/build/image.rb

@@ -1,4 +1,5 @@
 require_relative '../util'
+require_relative '../skopeo_helper'
 require_relative '../docker_operations'
 require_relative 'info/docker'
 
@@ -40,6 +41,20 @@ def tag_and_push_to_dockerhub(final_tag, initial_tag: Build::Info::Docker.tag)
       puts "Pushed #{dockerhub_image_name}:#{final_tag} to Docker Hub"
     end
 
+    def copy_image_to_dockerhub(final_tag)
+      source = source_image_address
+      target = "#{dockerhub_image_name}:#{final_tag}"
+
+      SkopeoHelper.login('gitlab-ci-token', Gitlab::Util.get_env('CI_JOB_TOKEN'), Gitlab::Util.get_env('CI_REGISTRY'))
+      SkopeoHelper.login(Gitlab::Util.get_env('DOCKERHUB_USERNAME'), Gitlab::Util.get_env('DOCKERHUB_PASSWORD'), 'docker.io')
+
+      SkopeoHelper.copy_image(source, target)
+    end
+
+    def source_image_address
+      raise NotImplementedError
+    end
+
     def write_release_file
       contents = Build::Info::Docker.release_file_contents
       File.write('docker/RELEASE', contents)

lib/gitlab/build/qa_image.rb

@@ -1,4 +1,3 @@
-require_relative '../skopeo_helper'
 require_relative 'gitlab_image'
 require_relative 'image'
 require_relative 'info/qa'
@@ -15,14 +14,8 @@ def self.gitlab_registry_image_name
       "#{Build::GitlabImage.gitlab_registry_image_name}-qa"
     end
 
-    def self.copy_image_to_dockerhub(final_tag)
-      source = Build::Info::QA.image
-      target = "#{dockerhub_image_name}:#{final_tag}"
-
-      SkopeoHelper.login('gitlab-ci-token', Gitlab::Util.get_env('CI_JOB_TOKEN'), Gitlab::Util.get_env('CI_REGISTRY'))
-      SkopeoHelper.login(Gitlab::Util.get_env('DOCKERHUB_USERNAME'), Gitlab::Util.get_env('DOCKERHUB_PASSWORD'), 'docker.io')
-
-      SkopeoHelper.copy_image(source, target)
+    def self.source_image_address
+      Build::Info::QA.image
     end
   end
 end

lib/gitlab/skopeo_helper.rb

@@ -34,7 +34,10 @@ def copy_image(source, target)
       end
 
       puts "\nCopying image `#{source}` to `#{target}`"
-      status = system(*%W[skopeo copy docker://#{source} docker://#{target}])
+
+      # The --all flag is used to support multi-arch, so we can copy all images
+      # with a single command
+      status = system(*%W[skopeo copy --all docker://#{source} docker://#{target}])
 
       raise "Failed to copy image." unless status
     end

lib/gitlab/tasks/docker_tasks.rake

@@ -38,28 +38,50 @@ namespace :docker do
 
     task :stable do
       Gitlab::Util.section('docker:push:stable') do
-        Build::GitlabImage.tag_and_push_to_dockerhub(Build::Info::Docker.tag)
+        if Gitlab::Util.get_env('USE_SKOPEO_FOR_DOCKER_RELEASE') == 'true'
+          Build::GitlabImage.copy_image_to_dockerhub(Build::Info::Docker.tag)
+        else
+          Build::GitlabImage.tag_and_push_to_dockerhub(Build::Info::Docker.tag)
+        end
       end
     end
 
     # Special tags
     task :nightly do
+      next unless Build::Check.is_nightly?
+
       Gitlab::Util.section('docker:push:nightly') do
-        Build::GitlabImage.tag_and_push_to_dockerhub('nightly') if Build::Check.is_nightly?
+        if Gitlab::Util.get_env('USE_SKOPEO_FOR_DOCKER_RELEASE') == 'true'
+          Build::GitlabImage.copy_image_to_dockerhub('nightly')
+        else
+          Build::GitlabImage.tag_and_push_to_dockerhub('nightly')
+        end
       end
     end
 
     # push as :rc tag, the :rc is always the latest tagged release
     task :rc do
+      next unless Build::Check.is_latest_tag?
+
       Gitlab::Util.section('docker:push:rc') do
-        Build::GitlabImage.tag_and_push_to_dockerhub('rc') if Build::Check.is_latest_tag?
+        if Gitlab::Util.get_env('USE_SKOPEO_FOR_DOCKER_RELEASE') == 'true'
+          Build::GitlabImage.copy_image_to_dockerhub('rc')
+        else
+          Build::GitlabImage.tag_and_push_to_dockerhub('rc')
+        end
       end
     end
 
     # push as :latest tag, the :latest is always the latest stable release
     task :latest do
+      next unless Build::Check.is_latest_stable_tag?
+
       Gitlab::Util.section('docker:push:latest') do
-        Build::GitlabImage.tag_and_push_to_dockerhub('latest') if Build::Check.is_latest_stable_tag?
+        if Gitlab::Util.get_env('USE_SKOPEO_FOR_DOCKER_RELEASE') == 'true'
+          Build::GitlabImage.copy_image_to_dockerhub('latest')
+        else
+          Build::GitlabImage.tag_and_push_to_dockerhub('latest')
+        end
       end
     end
 
@@ -78,6 +100,11 @@ namespace :docker do
   desc "Pull Docker Image from Registry"
   namespace :pull do
     task :staging do
+      if Gitlab::Util.get_env('USE_SKOPEO_FOR_DOCKER_RELEASE') == 'true'
+        puts "USE_SKOPEO_FOR_DOCKER_RELEASE is set. So skipping pulling image."
+        next
+      end
+
       Gitlab::Util.section('docker:pull:staging') do
         DockerOperations.authenticate("gitlab-ci-token", Gitlab::Util.get_env("CI_JOB_TOKEN"), Gitlab::Util.get_env('CI_REGISTRY'))
         Build::GitlabImage.pull

spec/lib/gitlab/skopeo_helper_spec.rb

@@ -33,7 +33,7 @@
     it 'calls skopeo copy command with correct arguments' do
       allow(Open3).to receive(:popen2e).with(*%w[skopeo inspect docker://foobar]).and_yield(nil, double(read: 'dummy_output'), double(value: double(success?: true)))
 
-      expect(described_class).to receive(:system).with(*%w[skopeo copy docker://foobar docker://dummy-target])
+      expect(described_class).to receive(:system).with(*%w[skopeo copy --all docker://foobar docker://dummy-target])
 
       described_class.copy_image('foobar', 'dummy-target')
     end

spec/lib/gitlab/tasks/docker_tasks_spec.rb

@@ -30,14 +30,32 @@
       allow(ENV).to receive(:[]).and_call_original
     end
 
-    it 'pulls in correct image' do
-      allow(ENV).to receive(:[]).with('CI_REGISTRY_IMAGE').and_return('dev.gitlab.org:5005/gitlab/omnibus-gitlab')
-      allow(Build::Info::Package).to receive(:name).and_return('gitlab-ce')
-      allow(Build::Info::Docker).to receive(:tag).and_return('9.0.0')
-      allow(DockerOperations).to receive(:authenticate).and_return(true)
+    context 'when USE_SKOPEO_FOR_DOCKER_RELEASE is set' do
+      before do
+        stub_env_var('USE_SKOPEO_FOR_DOCKER_RELEASE', 'true')
+      end
+
+      it 'does not pull image' do
+        expect(Docker::Image).not_to receive(:create).with('fromImage' => 'dev.gitlab.org:5005/gitlab/omnibus-gitlab/gitlab-ce:9.0.0')
+        Rake::Task['docker:pull:staging'].invoke
+      end
+    end
 
-      expect(Docker::Image).to receive(:create).with('fromImage' => 'dev.gitlab.org:5005/gitlab/omnibus-gitlab/gitlab-ce:9.0.0')
-      Rake::Task['docker:pull:staging'].invoke
+    context 'when USE_SKOPEO_FOR_DOCKER_RELEASE is not set' do
+      before do
+        stub_env_var('USE_SKOPEO_FOR_DOCKER_RELEASE', 'false')
+      end
+
+      it 'pulls in correct image' do
+        allow(ENV).to receive(:[]).with('CI_REGISTRY_IMAGE').and_return('dev.gitlab.org:5005/gitlab/omnibus-gitlab')
+        allow(Build::Info::Package).to receive(:name).and_return('gitlab-ce')
+        allow(Build::Info::Docker).to receive(:tag).and_return('9.0.0')
+        allow(DockerOperations).to receive(:authenticate).and_return(true)
+        allow(SkopeoHelper).to receive(:login).and_return(true)
+
+        expect(Docker::Image).to receive(:create).with('fromImage' => 'dev.gitlab.org:5005/gitlab/omnibus-gitlab/gitlab-ce:9.0.0')
+        Rake::Task['docker:pull:staging'].invoke
+      end
     end
   end
 
@@ -46,11 +64,7 @@
     let(:dummy_creds) { { username: "test", password: "test" } }
 
     before do
-      Rake::Task['docker:push:staging'].reenable
       Rake::Task['docker:push:stable'].reenable
-      Rake::Task['docker:push:nightly'].reenable
-      Rake::Task['docker:push:rc'].reenable
-      Rake::Task['docker:push:latest'].reenable
 
       allow(ENV).to receive(:[]).and_call_original
       allow(ENV).to receive(:[]).with('CI_REGISTRY_IMAGE').and_return('dev.gitlab.org:5005/gitlab/omnibus-gitlab')
@@ -61,44 +75,123 @@
       allow(Docker::Image).to receive(:get).and_return(dummy_image)
       allow(Docker).to receive(:creds).and_return(dummy_creds)
       allow(dummy_image).to receive(:tag).and_return(true)
+      allow(SkopeoHelper).to receive(:login).and_return(true)
+      allow(SkopeoHelper).to receive(:copy_image).and_return(true)
     end
 
-    it 'pushes to staging correctly' do
-      expect(dummy_image).to receive(:push).with(dummy_creds, repo_tag: 'dev.gitlab.org:5005/gitlab/omnibus-gitlab/gitlab-ce:9.0.0')
-      expect(dummy_image).to receive(:push).with(dummy_creds, repo_tag: 'dev.gitlab.org:5005/gitlab/omnibus-gitlab/gitlab-ce:foo-bar')
-      Rake::Task['docker:push:staging'].invoke
-    end
+    describe 'docker:push:staging' do
+      before do
+        Rake::Task['docker:push:staging'].reenable
+      end
 
-    it 'pushes nightly images correctly' do
-      allow(Build::Check).to receive(:is_nightly?).and_return(true)
-
-      expect(dummy_image).to receive(:push).with(dummy_creds, repo_tag: 'gitlab/gitlab-ce:nightly')
-      Rake::Task['docker:push:nightly'].invoke
+      it 'pushes to staging correctly' do
+        expect(dummy_image).to receive(:push).with(dummy_creds, repo_tag: 'dev.gitlab.org:5005/gitlab/omnibus-gitlab/gitlab-ce:9.0.0')
+        expect(dummy_image).to receive(:push).with(dummy_creds, repo_tag: 'dev.gitlab.org:5005/gitlab/omnibus-gitlab/gitlab-ce:foo-bar')
+        Rake::Task['docker:push:staging'].invoke
+      end
     end
 
-    it 'pushes latest images correctly' do
-      allow(Build::Check).to receive(:is_latest_stable_tag?).and_return(true)
-
-      expect(dummy_image).to receive(:push).with(dummy_creds, repo_tag: 'gitlab/gitlab-ce:latest')
-      Rake::Task['docker:push:latest'].invoke
+    describe 'docker:push:nightly' do
+      before do
+        Rake::Task['docker:push:nightly'].reenable
+        allow(Build::Check).to receive(:is_nightly?).and_return(true)
+      end
+
+      context 'when USE_SKOPEO_FOR_DOCKER_RELEASE is set' do
+        before do
+          stub_env_var('USE_SKOPEO_FOR_DOCKER_RELEASE', 'true')
+        end
+
+        it 'copies nightly images correctly' do
+          expect(SkopeoHelper).to receive(:copy_image).with('dev.gitlab.org:5005/gitlab/omnibus-gitlab/gitlab-ce:9.0.0', 'gitlab/gitlab-ce:nightly')
+          Rake::Task['docker:push:nightly'].invoke
+        end
+      end
+
+      context 'when USE_SKOPEO_FOR_DOCKER_RELEASE is not set' do
+        before do
+          stub_env_var('USE_SKOPEO_FOR_DOCKER_RELEASE', 'false')
+        end
+
+        it 'pushes nightly images correctly' do
+          expect(dummy_image).to receive(:push).with(dummy_creds, repo_tag: 'gitlab/gitlab-ce:nightly')
+          Rake::Task['docker:push:nightly'].invoke
+        end
+      end
     end
 
-    it 'pushes rc images correctly' do
-      allow(Build::Check).to receive(:is_latest_tag?).and_return(true)
-
-      expect(dummy_image).to receive(:push).with(dummy_creds, repo_tag: 'gitlab/gitlab-ce:rc')
-      Rake::Task['docker:push:rc'].invoke
+    describe 'docker:push:latest' do
+      before do
+        Rake::Task['docker:push:latest'].reenable
+        allow(Build::Check).to receive(:is_latest_stable_tag?).and_return(true)
+      end
+
+      context 'when USE_SKOPEO_FOR_DOCKER_RELEASE is set' do
+        before do
+          stub_env_var('USE_SKOPEO_FOR_DOCKER_RELEASE', 'true')
+        end
+
+        it 'copies latest images correctly' do
+          expect(SkopeoHelper).to receive(:copy_image).with('dev.gitlab.org:5005/gitlab/omnibus-gitlab/gitlab-ce:9.0.0', 'gitlab/gitlab-ce:latest')
+          Rake::Task['docker:push:latest'].invoke
+        end
+      end
+
+      context 'when USE_SKOPEO_FOR_DOCKER_RELEASE is not set' do
+        before do
+          stub_env_var('USE_SKOPEO_FOR_DOCKER_RELEASE', 'false')
+        end
+
+        it 'pushes latest images correctly' do
+          expect(dummy_image).to receive(:push).with(dummy_creds, repo_tag: 'gitlab/gitlab-ce:latest')
+          Rake::Task['docker:push:latest'].invoke
+        end
+      end
     end
 
-    it 'pushes triggered images correctly' do
-      allow(ENV).to receive(:[]).with('CI_COMMIT_REF_SLUG').and_return('foo-bar')
-      allow(ENV).to receive(:[]).with('CI_REGISTRY_IMAGE').and_return('registry.gitlab.com/gitlab-org/omnibus-gitlab')
-      allow(ENV).to receive(:[]).with("IMAGE_TAG").and_return("omnibus-12345")
-      allow(Build::Info::Docker).to receive(:tag).and_call_original
+    describe 'docker:push:rc' do
+      before do
+        Rake::Task['docker:push:rc'].reenable
+        allow(Build::Check).to receive(:is_latest_tag?).and_return(true)
+      end
+
+      context 'when USE_SKOPEO_FOR_DOCKER_RELEASE is set' do
+        before do
+          stub_env_var('USE_SKOPEO_FOR_DOCKER_RELEASE', 'true')
+        end
+
+        it 'copies rc images correctly' do
+          expect(SkopeoHelper).to receive(:copy_image).with('dev.gitlab.org:5005/gitlab/omnibus-gitlab/gitlab-ce:9.0.0', 'gitlab/gitlab-ce:rc')
+          Rake::Task['docker:push:rc'].invoke
+        end
+      end
+
+      context 'when USE_SKOPEO_FOR_DOCKER_RELEASE is not set' do
+        before do
+          stub_env_var('USE_SKOPEO_FOR_DOCKER_RELEASE', 'false')
+        end
+
+        it 'pushes rc images correctly' do
+          expect(dummy_image).to receive(:push).with(dummy_creds, repo_tag: 'gitlab/gitlab-ce:rc')
+          Rake::Task['docker:push:rc'].invoke
+        end
+      end
+    end
 
-      expect(dummy_image).to receive(:push).with(dummy_creds, repo_tag: 'registry.gitlab.com/gitlab-org/omnibus-gitlab/gitlab-ce:omnibus-12345')
-      expect(dummy_image).to receive(:push).with(dummy_creds, repo_tag: 'registry.gitlab.com/gitlab-org/omnibus-gitlab/gitlab-ce:foo-bar')
-      Rake::Task['docker:push:triggered'].invoke
+    describe 'docker:push:triggered' do
+      before do
+        Rake::Task['docker:push:triggered'].reenable
+        allow(ENV).to receive(:[]).with('CI_COMMIT_REF_SLUG').and_return('foo-bar')
+        allow(ENV).to receive(:[]).with('CI_REGISTRY_IMAGE').and_return('registry.gitlab.com/gitlab-org/omnibus-gitlab')
+        allow(ENV).to receive(:[]).with("IMAGE_TAG").and_return("omnibus-12345")
+        allow(Build::Info::Docker).to receive(:tag).and_call_original
+      end
+
+      it 'pushes triggered images correctly' do
+        expect(dummy_image).to receive(:push).with(dummy_creds, repo_tag: 'registry.gitlab.com/gitlab-org/omnibus-gitlab/gitlab-ce:omnibus-12345')
+        expect(dummy_image).to receive(:push).with(dummy_creds, repo_tag: 'registry.gitlab.com/gitlab-org/omnibus-gitlab/gitlab-ce:foo-bar')
+        Rake::Task['docker:push:triggered'].invoke
+      end
     end
   end
 end