CODEWITHSUNDEEP
google-cloud-platformgoogle-cloud-buildbeta
Dr. Fabien Tarrade
Dr. Fabien Tarrade

Reputation: 1706

How can I run beta gcloud component like "gcloud beta artifacts docker images scan" within Cloud Build?

I am trying to include the Container Analyis API link in a Cloud Build pipeline.This is a beta component and with command line I need to install it first:

gcloud components install beta local-extract

then I can run the on demand container analyis (if the container is present locally):

gcloud beta artifacts docker images scan ubuntu:latest

My question is how I can use component like beta local-extract within Cloud Build ?

I tried to do a fist step and install the missing componentL

## Update components
- name: 'gcr.io/cloud-builders/gcloud'
  args: ['components', 'install', 'beta', 'local-extract', '-q']
  id: Update component

but as soon as I move to the next step the update is gone (since it is not in the container)

I also tried to install the component and then run the scan using (& or ;) but it is failling:

## Run vulnerability scan
- name: 'gcr.io/cloud-builders/gcloud'
  args: ['components', 'install', 'beta', 'local-extract', '-q', ';', 'gcloud', 'beta', 'artifacts', 'docker', 'images', 'scan', 'ubuntu:latest', '--location=europe']

  id: Run vulnaribility scan

and I get:

Already have image (with digest): gcr.io/cloud-builders/gcloud
ERROR: (gcloud.components.install) unrecognized arguments:
  ;
  gcloud
  beta
  artifacts
  docker
  images
  scan
  ubuntu:latest
  --location=europe (did you mean '--project'?)
  To search the help text of gcloud commands, run:
  gcloud help -- SEARCH_TERMS

so my question are:

  1. how can I run "gcloud beta artifacts docker images scan ubuntu:latest" within Cloud Build ?
  2. bonus: from the previous command how can I get the "scan" output value that I will need to pass as a parameter to my next step ? (I guess it should be something with --format)

Upvotes: 0

Views: 1538

Answers (2)

guillaume blaquiere
guillaume blaquiere

Reputation: 75920

The problem comes from Cloud Build. It cache some often used images and if you want to use a brand new feature in GCLOUD CLI the cache can be too old.

I performed a test tonight, the version is 326 in cache. the 328 has just been released. So, the cached version has 2 weeks old, maybe too old for your feature. It could be worse in your region!

The solution to fix this, is to explicitly request the latest version.

  • Go to this url gcr.io/cloud-builders/gcloud

  • Copy the latest version enter image description here

  • Paste the full version name in the step of your Cloud Build pipeline.

The side effect is a longer build. Indeed, because this latest image isn't cached, it has to be downloaded in Cloud Build.

Upvotes: 0

coryan
coryan

Reputation: 826

You should try the cloud-sdk docker image:

https://github.com/GoogleCloudPlatform/cloud-sdk-docker

The Cloud Build team (implicitly?) recommends it:

https://github.com/GoogleCloudPlatform/cloud-builders/tree/master/gcloud

With the cloud-sdk-docker container you can change the entrypoint to bash pipe gcloud commands together. Here is an (ugly) example:

https://github.com/GoogleCloudPlatform/functions-framework-cpp/blob/d3a40821ff0c7716bfc5d2ca1037bcce4750f2d6/ci/build-examples.yaml#L419-L432

As to your bonus question. Yes, --format=value(the.name.of.the.field) is probably what you want. The trick is to know the name of the field. I usually start with --format=json on my development workstation to figure out the name.

Upvotes: 1

Related Questions