-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: install tools using go.mod for versioning #2562
fix: install tools using go.mod for versioning #2562
Conversation
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
deploy/Dockerfile
Outdated
# Add .docker config dir | ||
RUN mkdir -p /kaniko/.docker | ||
|
||
# Checksums can be obtained from https://github.com/GoogleCloudPlatform/docker-credential-gcr/releases/download/v2.1.8/checksums.txt | ||
ARG GCR_HELPER_SHA_linux_amd64="0da9a0878d34dc8b38ae76519b7137f3179f573cf9c84fec1b81e973b565e2f9" | ||
ARG GCR_HELPER_SHA_linux_386="2421d3242beb239eb640daf9dbfa4582416049a92ed93a207a0a3102fde4ea11" | ||
ARG GCR_HELPER_SHA_linux_s390x="5d18e62c5952d43993b7ee292f87d812ccd161d4e9d932fbc1567eb5d5013632" | ||
ARG GCR_HELPER_SHA_linux_arm64="9d0e67c18fb3e1e048120d06edb9e54e1c11f88139ec77dbc9830e8a8b31745c" | ||
COPY . . |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Move this step before the go install
calls so that go.mod
, go.sum
and vendor
are present when go install
is called.
# Get GCR credential helper | ||
# Until https://github.com/GoogleCloudPlatform/docker-credential-gcr/issues/128 is addressed, we need to use | ||
# the existing compiled versions distributed in GitHub releases | ||
ARG GCR_HELPER_VERSION="2.1.8" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
All this hackery is no longer needed. go install github.com/GoogleCloudPlatform/docker-credential-gcr
will install the local vendor
version of the tool. That version is controlled via go.mod
and go.sum
.
bbfdf9c
to
11cf53b
Compare
"europe-west8-docker.pkg.dev", | ||
"europe-west9-docker.pkg.dev", | ||
"europe-west12-docker.pkg.dev", | ||
"me-central1-docker.pkg.dev", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This line is the same as the change in GoogleCloudPlatform/docker-credential-gcr@62afb27
Showing that the vendoring is getting the right tool version.
github.com/aws/aws-sdk-go-v2/service/ecr v1.18.10 // indirect | ||
github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.16.1 // indirect | ||
github.com/cloudflare/circl v1.3.3 // indirect | ||
github.com/fsnotify/fsnotify v1.6.0 // indirect | ||
github.com/google/go-querystring v1.1.0 // indirect | ||
github.com/google/s2a-go v0.1.4 // indirect | ||
github.com/google/subcommands v1.2.0 // indirect | ||
github.com/hashicorp/hcl v1.0.0 // indirect | ||
github.com/magiconair/properties v1.8.5 // indirect | ||
github.com/mitchellh/mapstructure v1.4.1 // indirect | ||
github.com/moby/swarmkit/v2 v2.0.0-20230315203717-e28e8ba9bc83 // indirect | ||
github.com/pelletier/go-toml v1.9.5 // indirect | ||
github.com/pjbgf/sha1cd v0.3.0 // indirect | ||
github.com/skeema/knownhosts v1.1.1 // indirect | ||
github.com/spf13/cast v1.3.1 // indirect | ||
github.com/spf13/jwalterweatherman v1.1.0 // indirect | ||
github.com/spf13/viper v1.8.1 // indirect | ||
github.com/subosito/gotenv v1.2.0 // indirect | ||
github.com/toqueteos/webbrowser v1.2.0 // indirect | ||
google.golang.org/genproto/googleapis/api v0.0.0-20230530153820-e85fd2cbaebc // indirect | ||
google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc // indirect | ||
gopkg.in/ini.v1 v1.62.0 // indirect | ||
gopkg.in/yaml.v2 v2.4.0 // indirect |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
These are transitive dependencies that were being pulled dynamically, bypassing the local go.mod
, go.sum
, and vendor
.
github.com/aws/aws-sdk-go-v2 v1.18.0 | ||
github.com/aws/aws-sdk-go-v2/config v1.18.25 | ||
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.67 | ||
github.com/aws/aws-sdk-go-v2/service/s3 v1.33.1 | ||
github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20220228164355-396b2034c795 | ||
github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20230522190001-adf1bafd791a |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You can verify the versions of the tools by comparing the commits strings on the ends here with the commit sha's that were in the docker file.
c80fbdd
to
ef2d626
Compare
Thank you very much for the PR @liam-verta! +1 to the idea here, in attempting to build kaniko images (via Logs showing
Same command from the
|
@aaron-prindle However, the commit being used for I've diffed the
It looks like the |
Ah I see, thank you for explaining what was occuring @liam-verta. I think this should good to merge then as an improvement over our current setup once we get CI/CD green. Currently this PR has a link to full logs: relevant log snippet:
|
@aaron-prindle |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, thanks for the PR here @liam-verta!
…2562) * fix: install tools using go.mod for versioning * Add helpful instructions for tool updates. * Add comment * Add boilerplate * Update go.mod * Gofmt feedback
Description
Fixes #2561
Instead of hacking wildly to side step issues created by
go install <tool>@<version>
, switch togo install <tool>
with placeholder imports to makego mod
include the tools in the dependency graph.Already being used in https://github.com/vertaai/kaniko . Works great.
Submitter Checklist
These are the criteria that every PR should meet, please check them off as you
review them:
See the contribution guide for more details.
Reviewer Notes
Release Notes
Describe any changes here so maintainer can include it in the release notes, or delete this block.