Build container images (and push them to a registry) on Kubernetes

shipwright docker build Kubernetes

3 min read | by Jordi Prats

Shipwright is a framework that allow us to build container images and push them to remote registries from within a Kubernetes clusters. It supports popular tools such as Kaniko, Cloud Native Buildpacks and Buildah

Shipwright installation

To install shipwright we will need to install tekton, shipwright itself and predefined build strategies that they provide. We can do it using the following commands:

kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.34.1/release.yaml
kubectl apply -f https://github.com/shipwright-io/build/releases/download/v0.9.0/release.yaml
kubectl apply -f https://github.com/shipwright-io/build/releases/download/v0.9.0/sample-strategies.yaml

Create secrets

If we need to work with private repositories we will need to create some Kubernetes Secrets containing the key to use to be able to fetch the repository we want to build. To import ~/.ssh/id_rsa into a Kubernetes ssh-auth secret named githubssh we can use the following command:

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
metadata:
  name: githubssh
type: kubernetes.io/ssh-auth
data:
  ssh-privatekey: $(base64 -w0  ~/.ssh/id_rsa)
EOF

Again, to be able to push the container image, we are, most likely, going to have to authenticate against it. In case we want to push it to docker Hub we can use the following command (just needing to set docker-username, docker-username and docker-email to the appropriate values)

kubectl create secret docker-registry hubdocker \
  --docker-server=https://index.docker.io/v1/ \
  --docker-username=demouser \
  --docker-username=passw0rd \
  --docker-email=demouser@pet2cattle.com

We can, of course, use other solutions like KES to dynamically fetch secrets from an external source.

Build definition

To start defining the build process we'll have to create the Build object defining the template:

  • source: git repository containing the source to build
  • output: Where to upload the container to
apiVersion: shipwright.io/v1alpha1
kind: Build
metadata:
  name: build
spec:
  source:
    url: https://github.com/jordiprats/flask-pet2cattle
    credentials:
      name: githubssh
  strategy:
    name: kaniko
    kind: ClusterBuildStrategy
  output:
    image: docker.io/jordiprats/shipwright-test:latest
    credentials:
      name: hubdocker

Build instance

Using the Build as a template, we can now create a BuildRun that will create a Pod to actually build the container and upload it to the registry:

Using this object we can override the image name that it's going to use using spec.output.name:

apiVersion: shipwright.io/v1alpha1
kind: BuildRun
metadata:
  name: buildrun
spec:
  buildRef:
    name: build
  output:
    image: {{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}

As soon as we apply these objects on the cluster, it will start the build process: Building the container image and then uploading it to the registry using the image name defined on the BuildRun object:

$ kubectl get build
NAME    REGISTERED   REASON      BUILDSTRATEGYKIND      BUILDSTRATEGYNAME   CREATIONTIME
build   True         Succeeded   ClusterBuildStrategy   kaniko              8m10s
$ kubectl get buildrun
NAME       SUCCEEDED   REASON      STARTTIME   COMPLETIONTIME
buildrun   True        Succeeded   8m16s       7m39s
$ kubectl get pods
NAME                       READY   STATUS      RESTARTS   AGE
buildrun-rj2wv-pod-q4np5   0/2     Completed   0          8m26s

Posted on 30/05/2022

Categories