Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(evergreen): authenticate with docker so that we don't make unauthenticated pulls #6498

Merged
merged 12 commits into from
Nov 19, 2024
Merged

chore(evergreen): authenticate with docker so that we don't make unauthenticated pulls #6498

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
a106e63
docker login
lerouxb Nov 14, 2024
57e1290
rather log in when starting the envs
lerouxb Nov 14, 2024
26f05e3
also login before starting atlas cloud cluster
lerouxb Nov 14, 2024
7913bbc
also login for start-atlas-local
lerouxb Nov 15, 2024
9053899
conditionally log into docker
lerouxb Nov 15, 2024
9dd7547
invert the docker env var checks
lerouxb Nov 15, 2024
eb9507d
also log out of docker
lerouxb Nov 15, 2024
e978d17
credsStore from-env
lerouxb Nov 15, 2024
757e25a
no need to login
lerouxb Nov 15, 2024
74c3b23
unshift..
lerouxb Nov 15, 2024
12d8509
print docker config
lerouxb Nov 15, 2024
fd2ae6a
Merge branch 'main' into docker-login
lerouxb Nov 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions .evergreen/docker-config/bin/docker-credential-from-env
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
#!/bin/bash

set -euo pipefail

DOCKER_HUB_URL="https://index.docker.io/v1/"

STDIN=$(cat)

ACTION="$1"

case "$ACTION" in
get)
SERVER_URL="$STDIN"

if [[ "$SERVER_URL" == "$DOCKER_HUB_URL" ]]; then
if [[ -z "${DOCKERHUB_USERNAME:-}" || -z "${DOCKERHUB_PASSWORD:-}" ]]; then
echo "Error: DOCKERHUB_USERNAME or DOCKERHUB_PASSWORD environment variables are not set." >&2
exit 1
fi

echo "{\"Username\": \"$DOCKERHUB_USERNAME\", \"Secret\": \"$DOCKERHUB_PASSWORD\"}"
else
echo "Error: No credentials available for $SERVER_URL" >&2
exit 1
fi
;;

*)
echo "Unsupported action: $ACTION" >&2
exit 1
;;
esac
6 changes: 6 additions & 0 deletions .evergreen/docker-config/config.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
{
"auths": {
"https://index.docker.io/v1/": {}
},
"credsStore": "from-env"
}
2 changes: 2 additions & 0 deletions .evergreen/functions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,8 @@ variables:
GARASIGN_PASSWORD: ${garasign_password}
ARTIFACTORY_USERNAME: ${artifactory_username}
ARTIFACTORY_PASSWORD: ${artifactory_password}
DOCKERHUB_USERNAME: ${dockerhub_username}
DOCKERHUB_PASSWORD: ${dockerhub_password}

# This is here with the variables because anchors aren't supported across includes
post:
Expand Down
4 changes: 4 additions & 0 deletions .evergreen/print-compass-env.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,8 @@ function printCompassEnv() {
pathsToPrepend.unshift('/opt/mongodbtoolchain/v4/bin');
}

pathsToPrepend(`${originalPWD}/.evergreen/docker-config/bin`);
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No idea if this should use /cygdrive/c or /cygdrive/z.. we'll see.


PATH = maybePrependPaths(PATH, pathsToPrepend);
printVar('PATH', PATH);

Expand Down Expand Up @@ -113,6 +115,8 @@ function printCompassEnv() {

// https://jira.mongodb.org/browse/NODE-6320
printVar('GYP_DEFINES', `kerberos_use_rtld=${process.platform === 'linux'}`);

printVar('DOCKER_CONFIG', `${originalPWD}/.evergreen/docker-config`);
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not exactly a secret but we already have this code running everywhere and we need to build an abs path somehow 🤷

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this should not be everywhere, but just where we use docker without arifactory, which we use for signatures

Copy link
Contributor Author

@lerouxb lerouxb Nov 15, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's gonna be tricky. I'll try and refactor it - let's see if it works first.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems to have logged in to artifactory using the existing username/password vars we have for that and worked just fine.

We currently have most of our env vars together and this way it makes use of our existing code to that makes sure we don't accidentally leak secrets in logs. This way it should also be impossible to forget to log in and get all of evergreen rate limited if we ever start using docker in more places.

So I think we should just keep an eye on it for now and we can make more PRs to isolate that var if we have to. Worst case we just temporarily revert this PR.

}

printCompassEnv();
Loading