Skip to content

[chore] push docker images to docker hub #7263

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
atoulme wants to merge 4 commits into
base: main
Choose a base branch
from
Open

[chore] push docker images to docker hub #7263

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f571593
[chore] push docker images to docker hub
atoulme Feb 25, 2026
c8772df
wip
atoulme Mar 5, 2026
6f630cc
Merge branch 'main' into push_images_to_docker_hub
pjanotti Aug 22, 2026
e22c3d4
Merge branch 'main' into push_images_to_docker_hub
pjanotti Sep 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 34 additions & 23 deletions .gitlab-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,6 +150,7 @@ sast-scan:
- $SIGNING_PRD_URL
script:
- docker login -u $CIRCLECI_QUAY_USERNAME -p $CIRCLECI_QUAY_PASSWORD quay.io
- docker login -u splunk -p $DOCKER_HUB_TOKEN
- echo "listing images to be signed"
- cat tags_to_sign
- cat tags_to_sign | xargs -L1 artifact-ci sign docker
Expand Down Expand Up @@ -835,20 +836,24 @@ build-push-linux-image:
id_tokens: # http://go/gitlab-17
CI_JOB_JWT:
aud: $CICD_VAULT_ADDR
parallel:
matrix:
- BASE_TAG: [ "quay.io/signalfx/splunk-otel-collector", "splunk/otel-collector" ]
script:
- *docker-reader-role
- docker login -u $CIRCLECI_QUAY_USERNAME -p $CIRCLECI_QUAY_PASSWORD quay.io
- - docker login -u splunk -p $DOCKER_HUB_TOKEN

@jinja2 jinja2 Feb 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- - docker login -u splunk -p $DOCKER_HUB_TOKEN
- docker login -u splunk -p $DOCKER_HUB_TOKEN

also, should the username be hidden? or is the org name/repo namespace also username for dockerhub?

@atoulme atoulme Apr 3, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we can hide it, I'll do that

- |
# Set env vars
set -e
if [[ -n "${RELEASE_VERSION:-}" ]]; then
IMAGE_NAME="quay.io/signalfx/splunk-otel-collector"
IMAGE_NAME="${BASE_IMAGE}"
IMAGE_TAG=${RELEASE_VERSION#v}
elif [[ -n "${CI_COMMIT_TAG:-}" ]]; then
IMAGE_NAME="quay.io/signalfx/splunk-otel-collector"
IMAGE_NAME="${BASE_IMAGE}"
IMAGE_TAG=${CI_COMMIT_TAG#v}
else
IMAGE_NAME="quay.io/signalfx/splunk-otel-collector-dev"
IMAGE_NAME="${BASE_IMAGE}-dev"
IMAGE_TAG=${CI_COMMIT_SHA}
fi
LATEST_TAG=""
Expand All @@ -873,7 +878,7 @@ build-push-linux-image:
echo "Creating and pushing ${IMAGE_NAME}:${latest_tag} manifest"
docker buildx imagetools create --tag ${IMAGE_NAME}:${latest_tag} ${IMAGE_NAME}:${arch_tag}
fi
echo "${IMAGE_NAME}:${arch_tag}" > tags_to_sign_${arch}
echo "${IMAGE_NAME}:${arch_tag}" >> tags_to_sign_${arch}

@pjanotti pjanotti Feb 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any specific reason for this change or just good form?

@atoulme atoulme Feb 25, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

since we now have 2 jobs in parallel, I got spooked that file can be overridden. I think the name of the file might even need to be unique per parallel run

@pjanotti pjanotti Mar 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The file is uploaded as an artifact so you need to add ${BASE_TAG} to the file name and ensure that wherever it is used it is properly finding the expected files. I mean it already handles ${arch} you need to ensure that it also handles the addition of ${BASE_TAG} to the name.

done
artifacts:
paths:
Expand All @@ -891,15 +896,16 @@ build-push-linux-fips-image:
script:
- *docker-reader-role
- docker login -u $CIRCLECI_QUAY_USERNAME -p $CIRCLECI_QUAY_PASSWORD quay.io
- - docker login -u splunk -p $DOCKER_HUB_TOKEN
- |
# Set env vars
set -e
VERSION_TAG="${RELEASE_VERSION:-${CI_COMMIT_TAG:-}}"
if [[ -n "${VERSION_TAG}" ]]; then
IMAGE_NAME="quay.io/signalfx/splunk-otel-collector-fips"
IMAGE_NAME="${BASE_IMAGE}-fips"
IMAGE_TAG=${VERSION_TAG#v}
else
IMAGE_NAME="quay.io/signalfx/splunk-otel-collector-fips-dev"
IMAGE_NAME="${BASE_IMAGE}-fips-dev"
IMAGE_TAG=${CI_COMMIT_SHA}
fi
LATEST_TAG=""
Expand All @@ -923,12 +929,13 @@ build-push-linux-fips-image:
echo "Creating and pushing ${IMAGE_NAME}:${latest_tag} manifest"
docker buildx imagetools create --tag ${IMAGE_NAME}:${latest_tag} ${IMAGE_NAME}:${arch_tag}
fi
echo "${IMAGE_NAME}:${arch_tag}" > tags_to_sign_${arch}
echo "${IMAGE_NAME}:${arch_tag}" >> tags_to_sign_${arch}
done
artifacts:
paths:
- tags_to_sign_*


sign-linux-image-fips:
extends: .sign-docker
parallel:
Expand All @@ -954,6 +961,7 @@ build-push-windows-image:
parallel:
matrix:
- WIN_VERSION: ["2019", "2022"]
BASE_TAG: ["quay.io/signalfx/splunk-otel-collector", "splunk/otel-collector"]
needs:
- job: sign-exe
artifacts: true
Expand Down Expand Up @@ -984,18 +992,18 @@ build-push-windows-image:
- |
# Set env vars
if ($env:RELEASE_VERSION) {
$IMAGE_NAME = "quay.io/signalfx/splunk-otel-collector"
$OLD_IMAGE_NAME = "quay.io/signalfx/splunk-otel-collector-windows"
$IMAGE_NAME = "${BASE_TAG}"
$OLD_IMAGE_NAME = "${BASE_TAG}-windows"
$tagNumber = $env:RELEASE_VERSION.TrimStart("v")
$IMAGE_TAG = "${tagNumber}-${env:WIN_VERSION}"
} elseif ($env:CI_COMMIT_TAG) {
$IMAGE_NAME = "quay.io/signalfx/splunk-otel-collector"
$OLD_IMAGE_NAME = "quay.io/signalfx/splunk-otel-collector-windows"
$IMAGE_NAME = "${BASE_TAG}"
$OLD_IMAGE_NAME = "${BASE_TAG}-windows"
$tagNumber = $env:CI_COMMIT_TAG.TrimStart("v")
$IMAGE_TAG = "${tagNumber}-${env:WIN_VERSION}"
} else {
$IMAGE_NAME = "quay.io/signalfx/splunk-otel-collector-dev"
$OLD_IMAGE_NAME = "quay.io/signalfx/splunk-otel-collector-windows-dev"
$IMAGE_NAME = "${BASE_TAG}-dev"
$OLD_IMAGE_NAME = "${BASE_TAG}-windows-dev"
$IMAGE_TAG = "${env:CI_COMMIT_SHA}-${env:WIN_VERSION}"
}
$LATEST_TAG = ""
Expand Down Expand Up @@ -1088,6 +1096,7 @@ build-push-windows-fips-image:
parallel:
matrix:
- WIN_VERSION: ["2019", "2022"]
BASE_TAG: [ "quay.io/signalfx/splunk-otel-collector", "splunk/otel-collector" ]
needs:
- job: sign-exe
artifacts: true
Expand Down Expand Up @@ -1119,18 +1128,18 @@ build-push-windows-fips-image:
- |
# Set env vars
if ($env:RELEASE_VERSION) {
$IMAGE_NAME = "quay.io/signalfx/splunk-otel-collector-fips"
$OLD_IMAGE_NAME = "quay.io/signalfx/splunk-otel-collector-fips-windows"
$IMAGE_NAME = "${BASE_TAG}-fips"
$OLD_IMAGE_NAME = "${BASE_TAG}-fips-windows"
$tagNumber = $env:RELEASE_VERSION.TrimStart("v")
$IMAGE_TAG = "${tagNumber}-${env:WIN_VERSION}"
} elseif ($env:CI_COMMIT_TAG) {
$IMAGE_NAME = "quay.io/signalfx/splunk-otel-collector-fips"
$OLD_IMAGE_NAME = "quay.io/signalfx/splunk-otel-collector-fips-windows"
$IMAGE_NAME = "${BASE_TAG}-fips"
$OLD_IMAGE_NAME = "${BASE_TAG}-fips-windows"
$tagNumber = $env:CI_COMMIT_TAG.TrimStart("v")
$IMAGE_TAG = "${tagNumber}-${env:WIN_VERSION}"
} else {
$IMAGE_NAME = "quay.io/signalfx/splunk-otel-collector-fips-dev"
$OLD_IMAGE_NAME = "quay.io/signalfx/splunk-otel-collector-fips-windows-dev"
$IMAGE_NAME = "${BASE_TAG}-fips-dev"
$OLD_IMAGE_NAME = "${BASE_TAG}-fips-windows-dev"
$IMAGE_TAG = "${env:CI_COMMIT_SHA}-${env:WIN_VERSION}"
}
$LATEST_TAG = ""
Expand Down Expand Up @@ -1617,6 +1626,7 @@ push-multiarch-manifest:
matrix:
- MANIFEST: [multiarch, windows_multiarch]
FIPS: ["-fips",""]
BASE_TAG: [ "quay.io/signalfx/splunk-otel-collector", "splunk/otel-collector" ]
needs:
- sign-linux-image
- sign-windows-image
Expand All @@ -1626,16 +1636,17 @@ push-multiarch-manifest:
aud: $CICD_VAULT_ADDR
script:
- docker login -u $CIRCLECI_QUAY_USERNAME -p $CIRCLECI_QUAY_PASSWORD quay.io
- docker login -u splunk -p $DOCKER_HUB_TOKEN
- |
# Set env vars
VERSION_TAG="${RELEASE_VERSION:-${CI_COMMIT_TAG:-}}"
if [[ -n "${VERSION_TAG}" ]]; then
MANIFEST_NAME="quay.io/signalfx/splunk-otel-collector${FIPS}"
WIN_MANIFEST_NAME="quay.io/signalfx/splunk-otel-collector${FIPS}-windows"
MANIFEST_NAME="${BASE_TAG}${FIPS}"
WIN_MANIFEST_NAME="${BASE_TAG}${FIPS}-windows"
MANIFEST_TAG=${VERSION_TAG#v}
else
MANIFEST_NAME="quay.io/signalfx/splunk-otel-collector${FIPS}-dev"
WIN_MANIFEST_NAME="quay.io/signalfx/splunk-otel-collector${FIPS}-windows-dev"
MANIFEST_NAME="${BASE_TAG}${FIPS}-dev"
WIN_MANIFEST_NAME="${BASE_TAG}${FIPS}-windows-dev"
MANIFEST_TAG=${CI_COMMIT_SHA}
fi
LATEST_TAG=""
Expand Down
Loading