3e3f836435
This allows us to construct a job which allows users to pass in a secret (via pass-to-parent) which includes not only the user/pass, but also a restriction for what docker image repositories may be accessed using that user/pass. This allows an operator to create one credential, and then use that credential in multiple secrets for multiple projects, each with a distinct restriction on where images may be uploaded. Change-Id: I7a3cf97a16d34c76df8601990954e1f2b0e498f5
28 lines
839 B
YAML
28 lines
839 B
YAML
- name: Verify repository names
|
|
when: |
|
|
docker_credentials.repository is defined
|
|
and not item.repository | regex_search(docker_credentials.repository)
|
|
loop: "{{ docker_images }}"
|
|
fail:
|
|
msg: "{{ item.repository }} not permitted by {{ docker_credentials.repository }}"
|
|
# This is used by the delete tasks
|
|
- name: Get dockerhub JWT token
|
|
no_log: true
|
|
uri:
|
|
url: "https://hub.docker.com/v2/users/login/"
|
|
body_format: json
|
|
body:
|
|
username: "{{ docker_credentials.username }}"
|
|
password: "{{ docker_credentials.password }}"
|
|
register: jwt_token
|
|
- name: Promote image
|
|
loop: "{{ docker_images }}"
|
|
loop_control:
|
|
loop_var: image
|
|
include_tasks: promote-retag.yaml
|
|
- name: Delete obsolete tags
|
|
loop: "{{ docker_images }}"
|
|
loop_control:
|
|
loop_var: image
|
|
include_tasks: promote-cleanup.yaml
|