GoogleContainerTools / GoogleContainerTools/skaffold
Feature request: ability to remove sha256 or tag from generated docker image
- Dominant language
- Go
- Stars
- 15.9k
- Forks
- 1.7k
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 10
Description
### Background.
We are JFrog artifactory users, and are facing a few issues with the assumptions that Skaffold requires: every image contains both `@sha256` selector *and* a docker tag. JFrog artifactory has a few limitations here:
First, Artifactory is only capable of keeping a single image per tag, so in effect the sha256 selector makes sure that if the image is **ever** updated outside of our Skaffold run, it will expire the image.
This seems like a sane behavior but in practice we've had issues with our staging environment being deployed with 'dirty' changes, and a CI server running the same skaffold command to run tests will override the same tag, meaning that this invalidates our staging server.
We want to prohibit deploying 'dirty' changes to an end-to-end environment, [but there is no way to do that, either.](https://groups.google.com/g/skaffold-users/c/a6H17uUCFsg/m/ehajKB7RAgAJ)
Secondly, pull images by both sha and image is incredibly slow:
https://www.jfrog.com/jira/browse/RTFACT-19842?attachmentViewMode=list
Pulling the same image by either its label *or* by sha256 however, is not slow. I had some back-and-forth with our Artifactory admin on whether using both is even an expected behavior that should be supported, docker's official documentations use examples selecting by **either** label or sha, but not both, and that as far as looking at the docker documentation can tell this doesn't even appear to be a valid syntax:
https://docs.docker.com/engine/reference/commandline/pull/
### Expected behavior
Image can contain either sha256 or container tag
### Actual behavior
Every image contains both sha256 and container tag and this is not configurable and always required.
### Information
- Skaffold version: 1.8.0
- Operating system: OS X 10.14.6
- Contents of skaffold.yaml:
```yaml
apiVersion: skaffold/v2beta2
kind: Config
metadata:
name: my-server
build:
artifacts:
- image: my-server
docker:
dockerfile: Dockerfile.build
portForward:
- resourceType: deployment
resourceName: my-server
port: 3000
localPort: 3000
- resourceType: deployment
resourceName: mysql
port: 3306
localPort: 3306
profiles:
- name: docker-desktop
deploy:
kustomize:
paths:
- k8s/overlays/docker-desktop/
kubeContext: docker-desktop
- name: test
build:
artifacts:
- image: docker.corp.example.com/my-team/my-service
docker:
dockerfile: Dockerfile.build
tagPolicy:
gitCommit:
variant: AbbrevCommitSha
deploy:
kustomize:
paths:
- k8s/overlays/test/
statusCheckDeadlineSeconds: 180
- name: staging
build:
artifacts:
- image: docker.corp.example.com/my-team/my-service
docker:
dockerfile: Dockerfile.build
deploy:
kustomize:
paths:
- k8s/overlays/staging/
kubeContext: staging
statusCheckDeadlineSeconds: 180
- name: production
build:
artifacts:
- image: docker.corp.example.com/my-team/my-service
docker:
dockerfile: Dockerfile.build
deploy:
kustomize:
paths:
- k8s/overlays/production/
kubeContext: production
statusCheckDeadlineSeconds: 180
```
### Steps to reproduce the behavior
1. clone skaffold repo
2. cd `examples/microservices`
3. run `skaffold dev`
observe tag generated
```
Generating tags...
- gcr.io/k8s-skaffold/leeroy-web -> gcr.io/k8s-skaffold/leeroy-web:v0.41.0-60-g2871da1f
- gcr.io/k8s-skaffold/leeroy-app -> gcr.io/k8s-skaffold/leeroy-app:v0.41.0-60-g2871da1f
```
Note that image used also includes sha256
Contributor guide
Assessment
This issue has not been assessed yet.