// CreateBuildPod creates the pod to be used for the Docker build
// TODO: Make the Pod definition configurable
func (bs *DockerBuildStrategy) CreateBuildPod(build *buildapi.Build) (*kapi.Pod, error) {
data, err := bs.Codec.Encode(build)
if err != nil {
return nil, fmt.Errorf("failed to encode the build: %v", err)
}
privileged := true
strategy := build.Spec.Strategy.DockerStrategy
containerEnv := []kapi.EnvVar{
{Name: "BUILD", Value: string(data)},
{Name: "BUILD_LOGLEVEL", Value: fmt.Sprintf("%d", cmdutil.GetLogLevel())},
}
addSourceEnvVars(build.Spec.Source, &containerEnv)
if len(strategy.Env) > 0 {
mergeTrustedEnvWithoutDuplicates(strategy.Env, &containerEnv)
}
pod := &kapi.Pod{
ObjectMeta: kapi.ObjectMeta{
Name: buildutil.GetBuildPodName(build),
Namespace: build.Namespace,
Labels: getPodLabels(build),
},
Spec: kapi.PodSpec{
ServiceAccountName: build.Spec.ServiceAccount,
Containers: []kapi.Container{
{
Name: "docker-build",
Image: bs.Image,
Env: containerEnv,
Args: []string{"--loglevel=" + fmt.Sprintf("%d", cmdutil.GetLogLevel())},
// TODO: run unprivileged https://github.com/openshift/origin/issues/662
SecurityContext: &kapi.SecurityContext{
Privileged: &privileged,
},
},
},
RestartPolicy: kapi.RestartPolicyNever,
},
}
pod.Spec.Containers[0].ImagePullPolicy = kapi.PullIfNotPresent
pod.Spec.Containers[0].Resources = build.Spec.Resources
setupDockerSocket(pod)
setupDockerSecrets(pod, build.Spec.Output.PushSecret, strategy.PullSecret)
setupSourceSecrets(pod, build.Spec.Source.SourceSecret)
return pod, nil
}
// CreateBuildPod creates a pod that will execute the STI build
// TODO: Make the Pod definition configurable
func (bs *SourceBuildStrategy) CreateBuildPod(build *buildapi.Build) (*kapi.Pod, error) {
data, err := bs.Codec.Encode(build)
if err != nil {
return nil, fmt.Errorf("failed to encode the Build %s/%s: %v", build.Namespace, build.Name, err)
}
containerEnv := []kapi.EnvVar{
{Name: "BUILD", Value: string(data)},
{Name: "SOURCE_REPOSITORY", Value: build.Spec.Source.Git.URI},
{Name: "BUILD_LOGLEVEL", Value: fmt.Sprintf("%d", cmdutil.GetLogLevel())},
}
strategy := build.Spec.Strategy.SourceStrategy
if len(strategy.Env) > 0 {
mergeTrustedEnvWithoutDuplicates(strategy.Env, &containerEnv)
}
// check if can run container as root
if !bs.canRunAsRoot(build) {
containerEnv = append(containerEnv, kapi.EnvVar{Name: "ALLOWED_UIDS", Value: "1-"})
}
privileged := true
pod := &kapi.Pod{
ObjectMeta: kapi.ObjectMeta{
Name: buildutil.GetBuildPodName(build),
Namespace: build.Namespace,
Labels: getPodLabels(build),
},
Spec: kapi.PodSpec{
ServiceAccountName: build.Spec.ServiceAccount,
Containers: []kapi.Container{
{
Name: "sti-build",
Image: bs.Image,
Env: containerEnv,
// TODO: run unprivileged https://github.com/openshift/origin/issues/662
SecurityContext: &kapi.SecurityContext{
Privileged: &privileged,
},
Args: []string{"--loglevel=" + getContainerVerbosity(containerEnv)},
},
},
RestartPolicy: kapi.RestartPolicyNever,
},
}
pod.Spec.Containers[0].ImagePullPolicy = kapi.PullIfNotPresent
pod.Spec.Containers[0].Resources = build.Spec.Resources
setupDockerSocket(pod)
setupDockerSecrets(pod, build.Spec.Output.PushSecret, strategy.PullSecret)
setupSourceSecrets(pod, build.Spec.Source.SourceSecret)
return pod, nil
}
// CreateBuildPod creates a pod that will execute the STI build
// TODO: Make the Pod definition configurable
func (bs *SourceBuildStrategy) CreateBuildPod(build *buildapi.Build) (*kapi.Pod, error) {
data, err := runtime.Encode(bs.Codec, build)
if err != nil {
return nil, fmt.Errorf("failed to encode the Build %s/%s: %v", build.Namespace, build.Name, err)
}
containerEnv := []kapi.EnvVar{
{Name: "BUILD", Value: string(data)},
{Name: "BUILD_LOGLEVEL", Value: fmt.Sprintf("%d", cmdutil.GetLogLevel())},
}
addSourceEnvVars(build.Spec.Source, &containerEnv)
addOriginVersionVar(&containerEnv)
strategy := build.Spec.Strategy.SourceStrategy
if len(strategy.Env) > 0 {
mergeTrustedEnvWithoutDuplicates(strategy.Env, &containerEnv)
}
// check if can run container as root
if !bs.canRunAsRoot(build) {
// TODO: both AllowedUIDs and DropCapabilities should
// be controlled via the SCC that's in effect for the build service account
// For now, both are hard-coded based on whether the build service account can
// run as root.
containerEnv = append(containerEnv, kapi.EnvVar{Name: buildapi.AllowedUIDs, Value: "1-"})
containerEnv = append(containerEnv, kapi.EnvVar{Name: buildapi.DropCapabilities, Value: strings.Join(DefaultDropCaps, ",")})
}
privileged := true
pod := &kapi.Pod{
ObjectMeta: kapi.ObjectMeta{
Name: buildapi.GetBuildPodName(build),
Namespace: build.Namespace,
Labels: getPodLabels(build),
},
Spec: kapi.PodSpec{
ServiceAccountName: build.Spec.ServiceAccount,
Containers: []kapi.Container{
{
Name: "sti-build",
Image: bs.Image,
Env: containerEnv,
// TODO: run unprivileged https://github.com/openshift/origin/issues/662
SecurityContext: &kapi.SecurityContext{
Privileged: &privileged,
},
Args: []string{"--loglevel=" + getContainerVerbosity(containerEnv)},
},
},
RestartPolicy: kapi.RestartPolicyNever,
},
}
pod.Spec.Containers[0].ImagePullPolicy = kapi.PullIfNotPresent
pod.Spec.Containers[0].Resources = build.Spec.Resources
if build.Spec.CompletionDeadlineSeconds != nil {
pod.Spec.ActiveDeadlineSeconds = build.Spec.CompletionDeadlineSeconds
}
if build.Spec.Source.Binary != nil {
pod.Spec.Containers[0].Stdin = true
pod.Spec.Containers[0].StdinOnce = true
}
setupDockerSocket(pod)
setupDockerSecrets(pod, build.Spec.Output.PushSecret, strategy.PullSecret, build.Spec.Source.Images)
setupSourceSecrets(pod, build.Spec.Source.SourceSecret)
setupSecrets(pod, build.Spec.Source.Secrets)
return pod, nil
}