[image-builder] replace reference to aliases with actual repo for cross mount blobs

[princerachit]

Description

Some registries like azure do not fail if the reference to the cross repo is incorrect while some fail due to it. This PR makes sure such references to aliases are appropriately replaced.

Related Issue(s)

Fixes #7264

How to test

You can watch me blabbering how this works in this loom video or proceed to following sections to learn how to test.

Cross mount repository fix for image-builder - Watch Video

Use the installer generated from this PR's build. You need a kubernetes cluster and need to install gitpod using the installer.

1. Create a gitlab registry
2. Create a personal access token with read and write permission to your registry
3. Create a docker secret using your credentials

kubectl create secret docker-registry registry-secret --docker-server=registry.gitlab.com --docker-username=prince41 --docker-password="mypassword"

4. Make the following changes to the gitpod config (generated via ./installer init > gitpod-config.yaml)

certificate:
  kind: secret
  name: https-certificates
containerRegistry:
  inCluster: false
  external:
    url: registry.gitlab.com/prince41/testproj
    certificate:
      kind: secret
      name: registry-secret

I also configured the experimental field as I tested this on workspace-preview which by default does an experimental installation:

experimental:
  webapp:
    server:
      disableDynamicAuthProviderLogin: false
      enableLocalApp: true
      defaultBaseImageRegistryWhitelist:
      - https://index.docker.io/v1/
      - https://azurecr.io/
      - https://prince.azurecr.io/
      - https://prince.azurecr.io/base-images
      - https://prince.azurecr.io/workspace-images
      - https://registry.gitlab.io/
      - https://registry.gitlab.io/prince41/
      - https://registry.gitlab.io/prince41/testproj

Make sure you correctly configure domain before moving on to the next steps.

5. Generate gitpod yamls and apply

installer render --use-experimental-config --config gitpod-config.yaml > rendered.yaml
kubectl apply -f rendered.yaml

Now use a repo which has a gitpod configuration similar to this:

image:
  file: gitpod.Dockerfile

and the corresponding gitpod.Dockerfile:

FROM gitpod/workspace-full:latest

RUN touch /tmp/abc && echo "done"

Image build should work without any issue.

Release Notes

Fix Cross mount blob error

Documentation

[kylos101]

/hold as we just had an incident https://gitpod.slack.com/archives/C03GSLDKVTM, and should make sure this is tested in a preview environment (can build images) as well as when Gitlab is the registry.

[kylos101]

Figure we can remove the hold once we understand how the breaking behavior for the prior PR for image builder made it to production. In other words, how can we do better with testing to a repeat incident?

[sagor999]

@kylos101 I think previous production issue was due to pinning of bob to specific version. So we did test everything correctly on our end in that case.

[kylos101]

/werft run

👍 started the job as gitpod-build-prs-pvt-reg.5
(with .werft/ from main)

[sagor999]

Rebased PR on latest main so that build will not fail.

[kylos101]

Thanks @sagor999 ! Have a nice vacation. 😃

There are a few image builder PRs that we have out there, so I'll be sure to rebase them too.

I plan to work with WebApp (@geropl ) on Tuesday to understand how related testing and deploys are done. I am out on Monday.

I assume we first must remove a pin in the ops repo, but would also like how to deploy to staging, and eventually production for webapp. This should also help the team eventually get image-builder onto workspace clusters...which would be great!

[princerachit]

I have rebased and resolved conflict.

[sagor999]

@kylos101 ping, I assume you taking ownership of reviewing and approving this PR based on your comment above?

[kylos101]

Hi @sagor999 no, but, I've added as part of this epic (to step 1), which we'll be starting soon. 🙏 Thank you for asking.

[stale]

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[sagor999]

not stale

[sagor999]

Going to mark this review as draft, as I am not sure who is owning this PR at this moment. @kylos101