Image author / commit empty in oc image built thru jenkins shared lib #47

michaelsauter · 2018-12-03T12:00:57Z

For some reason, the author of the image produced by the Jenkins build is unknown. This information should be set though as the commit author is known.

clemensutschig · 2019-02-01T13:23:10Z

the difference is driven by the BC - if the BC is based on a GIT commit / git source then the author of the commit is taken

if the source is binary ...

Author
Unknown
Built
3 months ago
Digest
sha256:80bffd16ff2694e8b247206d0ec623f6def14306ec878ebe7f89714d48ca9041
Identifier
sha256:7d507dd355c894c43eeca9f943bd53c7bebbf61018ef5fada1cbb4ca7c77ab46
Labels
io.openshift.build.name=be-spring-boot-1-1
io.openshift.build.namespace=cle335-test

we have to fix this asap - because it kills tracibility!

clemensutschig · 2019-02-01T13:32:06Z

see https://github.com/opendevstack/ods-jenkins-shared-library/blob/master/src/org/ods/OdsContext.groovy#L116

we have the commit / branch etc ... we may need the author and the message as well
$ git show --format="%ae %ad %s" bc1e3541158b02783146bee112da4cb3387d9eea
40628552+clemensutschig@users.noreply.github.com Wed Nov 21 09:00:08 2018 +0100 Feature/confluence permission raise (#60)

but then
https://github.com/opendevstack/ods-jenkins-shared-library/blob/master/vars/stageStartOpenshiftBuild.groovy#L10

could use this :) (question, but how?- via env,.... )

@renedupont - can you pick this up - this is a big one!
@michaelsauter - any ideas on label / env? ...

clemensutschig · 2019-02-01T14:07:02Z

update:
the author on the image - comes from dockerfile's author .. BUT

the *io. pieces come from the build config instance (use the BuildConfig.spec.output.imageLabels field to specify a list of custom labels that will be applied to each image built from the BuildConfig.)

and here is how :)

https://docs.openshift.com/container-platform/3.4/dev_guide/builds/build_output.html

michaelsauter · 2019-02-04T07:59:53Z

@renedupont Can you look into this - let me know if you need help.

renedupont · 2019-02-10T23:41:45Z

I talked to @michaelsauter about it and started working on it, should be done in a couple of days.

renedupont · 2019-02-15T14:49:02Z

After implementing this for the label io.openshift.build.commit.author it turns out, that this is not the label that openshift pulls for the Author field in the Details view of the Image.
It just showed it like this there:

What I found out though is that this Author field is the MAINTAINER of the Docker image.
I put this in the dockerfile

and it was filled then in openshift:

This seems to be rather unhelpful regarding tracibility.

The question is now what we want to have here?

clemensutschig · 2019-02-15T15:36:09Z

@renedupont Put all the Info into labels
. Commit hash message Author and branch.. and date.. ;-)

clemensutschig · 2019-03-01T12:15:29Z

so here is the list of thngs we should put in

source repo URL (source.repo.url)
branch (source.repo.branch)
commit hash (source.repo.commit)
message (source.repo.commit.msg)
author (source.repo.commit.author)
time of commit (source.repo.commit.time)
jenkins build job url (jenkins.job.url)
date of build (date)
ODS shared lib version (lib.version)
ODS openshift build server (openshift.server)

I would stick them all under ods.build.

for the last one
oc project | cut -d "/" -f3 | cut -d "\"" -f1 does the trick

or

def ocAPiUrl = sh(returnStdout: true, script: 'oc project ${PROJECT}-cd').trim()
ocAPiUrl = ocAPiUrl.substring(ocAPiUrl.indexOf("http")).replaceAll("\".", "")

renedupont · 2019-03-02T12:42:00Z

@clemensutschig I was now able to retrieve all of the information and present them as labels, BUT the shared lib version that we wanted to get via

config.odsSharedLibVersion = script.env["library.ods-library.version"]

causes a RejectAccessException during the build since it runs in a groovy sandbox. The precise exception is:

org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.lang.Object java.lang.String at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.StaticWhitelist.rejectStaticMethod(StaticWhitelist.java:189) at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onGetArray(SandboxInterceptor.java:447) at org.kohsuke.groovy.sandbox.impl.Checker$10.call(Checker.java:415) at org.kohsuke.groovy.sandbox.impl.Checker.checkedGetArray(Checker.java:420) at com.cloudbees.groovy.cps.sandbox.SandboxInvoker.getArray(SandboxInvoker.java:45) at com.cloudbees.groovy.cps.impl.ArrayAccessBlock.rawGet(ArrayAccessBlock.java:21) at org.ods.OdsContext.assemble(file:/var/lib/jenkins/jobs/owasp-cd/jobs/owasp-cd-be-spring-boot-2-master/builds/37/libs/ods-library/src/org/ods/OdsContext.groovy:44) at org.ods.OdsPipeline.execute(file:/var/lib/jenkins/jobs/owasp-cd/jobs/owasp-cd-be-spring-boot-2-master/builds/37/libs/ods-library/src/org/ods/OdsPipeline.groovy:28) at ___cps.transform___(Native Method) at com.cloudbees.groovy.cps.impl.PropertyishBlock$ContinuationImpl.get(PropertyishBlock.java:74) at com.cloudbees.groovy.cps.LValueBlock$GetAdapter.receive(LValueBlock.java:30) at com.cloudbees.groovy.cps.impl.PropertyishBlock$ContinuationImpl.fixName(PropertyishBlock.java:66) at sun.reflect.GeneratedMethodAccessor410.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at com.cloudbees.groovy.cps.impl.ContinuationPtr$ContinuationImpl.receive(ContinuationPtr.java:72) at com.cloudbees.groovy.cps.impl.ConstantBlock.eval(ConstantBlock.java:21) at com.cloudbees.groovy.cps.Next.step(Next.java:83) at com.cloudbees.groovy.cps.Continuable$1.call(Continuable.java:174) at com.cloudbees.groovy.cps.Continuable$1.call(Continuable.java:163) at org.codehaus.groovy.runtime.GroovyCategorySupport$ThreadCategoryInfo.use(GroovyCategorySupport.java:122) at org.codehaus.groovy.runtime.GroovyCategorySupport.use(GroovyCategorySupport.java:261) at com.cloudbees.groovy.cps.Continuable.run0(Continuable.java:163) at org.jenkinsci.plugins.workflow.cps.SandboxContinuable.access$001(SandboxContinuable.java:19) at org.jenkinsci.plugins.workflow.cps.SandboxContinuable$1.call(SandboxContinuable.java:35) at org.jenkinsci.plugins.workflow.cps.SandboxContinuable$1.call(SandboxContinuable.java:32) at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovySandbox.runInSandbox(GroovySandbox.java:108) at org.jenkinsci.plugins.workflow.cps.SandboxContinuable.run0(SandboxContinuable.java:32) at org.jenkinsci.plugins.workflow.cps.CpsThread.runNextChunk(CpsThread.java:174) at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup.run(CpsThreadGroup.java:331) at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup.access$100(CpsThreadGroup.java:82) at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup$2.call(CpsThreadGroup.java:243) at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup$2.call(CpsThreadGroup.java:231) at org.jenkinsci.plugins.workflow.cps.CpsVmExecutorService$2.call(CpsVmExecutorService.java:64) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at hudson.remoting.SingleLaneExecutorService$1.run(SingleLaneExecutorService.java:112) at jenkins.util.ContextResettingExecutorService$1.run(ContextResettingExecutorService.java:28) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748)

To allow that access it is possible to manually allow it in Jenkins Web UI under Script Approval:

After allowing, it shows successfully the lib version, in my case it is the branch name I am testing it on.

Since we obviously don't want to do this manually for every jenkins instance, besides being a security risk according to the script approval message, the question is how we deal with this. I remember there were similar issues in the past with this sandbox rejecting access, any idea how it was dealt with @michaelsauter ?

clemensutschig · 2019-03-02T12:43:34Z

@renedupont ' then lets leave this one out.

clemensutschig · 2019-03-02T12:55:11Z

Other Option- sh "env | grep"

renedupont · 2019-03-03T18:11:28Z

echo script.sh(script: 'env|grep', returnStdout: true)
This resulted in
ERROR: script returned exit code 2
Then I did
echo script.sh(script: 'env|sort', returnStdout: true)
to see all env vars but regarding the ods library version it just showed as expected:
library.ods-library.version=feature/branchname

I'll take it out for now since it seems not to be accessible without this security issue.

clemensutschig · 2019-03-03T18:15:34Z

env | grep "library.ods-library.version" should do .. grep expects an argument WHAT do search for ... :)

$ env | grep HOST
HOSTNAME=....

renedupont · 2019-03-03T18:45:47Z

oh thank you, that helped 👍
It ended up being this:
script.sh(script: "env | grep 'library.ods-library.version' | cut -d= -f2", returnStdout: true)

clemensutschig · 2019-03-03T19:01:54Z

Nice. Pull in @michaelsauter tmrw to help with Upstream

michaelsauter · 2019-03-04T09:58:38Z

@clemensutschig @renedupont I realised what you used for ODS openshift build server (openshift.server) returns a private IP address :( I guess we can leave that out ...

Adds information from Git to image via labels. Closes opendevstack#47.

…m feature/BIX-531-git-lfs-jenkins-configuration to production * commit '2c12edc6e9355c520d2c76d4c009aa30c72c8b4f': adding git lfs migrate note in readme file adding whole GitSCM configuration GitSCMSource not resolved from Jenkins, switching to GitSCM checkout with git lfs extension enabled

michaelsauter added the bug Something isn't working label Dec 3, 2018

michaelsauter added this to To Do in OpenDevStack 1.1.0 Dec 3, 2018

clemensutschig added this to To do in OpenDevStack 1.0.2 Feb 1, 2019

clemensutschig changed the title ~~Image author in OpenShift is unknown~~ Image author / commit empty in oc image built thru jenkins shared lib Feb 1, 2019

michaelsauter assigned renedupont Feb 4, 2019

michaelsauter removed this from To Do in OpenDevStack 1.1.0 Feb 4, 2019

clemensutschig mentioned this issue Mar 1, 2019

output link to OpenShift build and image in jenkins build log #48

Closed

clemensutschig moved this from To do to In progress in OpenDevStack 1.0.2 Mar 4, 2019

clemensutschig added this to In Progress in OpenDevStack 1.1.0 Mar 4, 2019

michaelsauter pushed a commit to BIX-Digital/ods-jenkins-shared-library that referenced this issue Mar 4, 2019

Add missing image labels

8d34e90

Adds information from Git to image via labels. Closes opendevstack#47.

This was referenced Mar 4, 2019

Add missing image labels #65

Merged

Fix image labels for 1.0.x #66

Merged

michaelsauter closed this as completed in #65 Mar 4, 2019

michaelsauter moved this from In progress to Done in OpenDevStack 1.0.2 Mar 4, 2019

michaelsauter moved this from In Progress to Done in OpenDevStack 1.1.0 Mar 4, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Image author / commit empty in oc image built thru jenkins shared lib #47

Image author / commit empty in oc image built thru jenkins shared lib #47

michaelsauter commented Dec 3, 2018

clemensutschig commented Feb 1, 2019

clemensutschig commented Feb 1, 2019 •

edited

Loading

clemensutschig commented Feb 1, 2019 •

edited

Loading

michaelsauter commented Feb 4, 2019

renedupont commented Feb 10, 2019

renedupont commented Feb 15, 2019

clemensutschig commented Feb 15, 2019 •

edited

Loading

clemensutschig commented Mar 1, 2019 •

edited

Loading

renedupont commented Mar 2, 2019

clemensutschig commented Mar 2, 2019

clemensutschig commented Mar 2, 2019

renedupont commented Mar 3, 2019

clemensutschig commented Mar 3, 2019

renedupont commented Mar 3, 2019

clemensutschig commented Mar 3, 2019 •

edited

Loading

michaelsauter commented Mar 4, 2019

Image author / commit empty in oc image built thru jenkins shared lib #47

Image author / commit empty in oc image built thru jenkins shared lib #47

Comments

michaelsauter commented Dec 3, 2018

clemensutschig commented Feb 1, 2019

clemensutschig commented Feb 1, 2019 • edited Loading

clemensutschig commented Feb 1, 2019 • edited Loading

michaelsauter commented Feb 4, 2019

renedupont commented Feb 10, 2019

renedupont commented Feb 15, 2019

clemensutschig commented Feb 15, 2019 • edited Loading

clemensutschig commented Mar 1, 2019 • edited Loading

renedupont commented Mar 2, 2019

clemensutschig commented Mar 2, 2019

clemensutschig commented Mar 2, 2019

renedupont commented Mar 3, 2019

clemensutschig commented Mar 3, 2019

renedupont commented Mar 3, 2019

clemensutschig commented Mar 3, 2019 • edited Loading

michaelsauter commented Mar 4, 2019

clemensutschig commented Feb 1, 2019 •

edited

Loading

clemensutschig commented Feb 1, 2019 •

edited

Loading

clemensutschig commented Feb 15, 2019 •

edited

Loading

clemensutschig commented Mar 1, 2019 •

edited

Loading

clemensutschig commented Mar 3, 2019 •

edited

Loading