jobs:build-node-image: support publishing v2s2 manifests

Some ART tooling does not support OCI manifests yet,
so allow creating the manifests in v2s2 support.

This is already supported by COSA so it's just
passing the correct flag and tie it to a knob.
Defaults to false.

Author: jbtrystram

docs/config.yaml

@@ -316,12 +316,18 @@ ocp_node_builds:
     # REQUIRED: knobs related to the source config
     registries:
         # REQUIRED: staging repo to push the final image built
-        staging: registry.ci.openshift.org/coreos/node-staginear
+        staging:
+          image: registry.ci.openshift.org/coreos/node-staging
+          # REQUIRED: one or more tags to attach to the image
+          tags: ["${RELEASE}-node-image"]
         # REQUIRED: prodution repo to push the final image built
         prod:
           # REQUIRED: the image to push to
           image: quay.io/openshift-release-dev/ocp-v4.0-art-dev
           # REQUIRED: one or more tags to attach to the image
           tags:
-            - "{RELEASE}-node-image"
-            - "{RELEASE}-{TIMESTAMP}-node-image"
+            - "${RELEASE}-node-image"
+            - "${RELEASE}-${TIMESTAMP}-node-image"
+          # OPTIONAL: whether to push in v2s2 format rather than OCI
+          # Default to false if not specified
+          v2s2: false

jobs/build-node-image.Jenkinsfile

@@ -73,6 +73,7 @@ lock(resource: "build-node-image") {
         // intermediary images before they are referenced in a multi-arch manifest.
         def registry_staging_tag = registry_staging_tags[0]
 
+        def v2s2 = pipecfg.ocp_node_builds.registries.prod.v2s2 ?: false
         // add any additional root CA cert before we do anything that fetches
         pipeutils.addOptionalRootCA()
 
@@ -100,6 +101,7 @@ lock(resource: "build-node-image") {
                                                 manifest_tag_staging: "${registry_staging_tag}",
                                                 secret: "id=yumrepos,src=${yumrepos_file}", // notsecret (for secret scanners)
                                                 from: build_from,
+                                                v2s2: v2s2,
                                                 extra_build_args: ["--security-opt label=disable", "--mount-host-ca-certs", "--force"])
             }
         }
@@ -115,6 +117,7 @@ lock(resource: "build-node-image") {
                                                manifest_tag_staging: "${registry_staging_tag}-extensions",
                                                secret: "id=yumrepos,src=${yumrepos_file}", // notsecret (for secret scanners)
                                                from: build_from,
+                                               v2s2: v2s2,
                                                extra_build_args: ["--security-opt label=disable", "--mount-host-ca-certs",
                                                                   "--git-containerfile", "extensions/Dockerfile", "--force"])
             }

utils.groovy

@@ -868,15 +868,18 @@ def build_remote_image(arches, commit, url, repo, tag, secret=None, from=None,
     return digest_list
 }
 
-def push_manifest(digests, repo, manifest_tag) {
+def push_manifest(digests, repo, manifest_tag, v2s2) {
     def images = ""
     for (digest in digests) {
         images += " --image=docker://${repo}@${digest}"
     }
     def digest = ""
     def digest_file = "${manifest_tag}.digestfile"
     // save the digest to a file named after the tag we are pushing
-    push_args = ["--write-digest-to-file", digest_file]
+    def push_args = ["--write-digest-to-file", digest_file]
+    if (v2s2) {
+        push_args += ["--v2s2"]
+    }
     // arbitrarily selecting the s390x builder; we don't run this
     // locally because podman wants user namespacing (yes, even just
     // to push a manifest...)
@@ -929,16 +932,18 @@ def build_and_push_image(params = [:]) {
     // src_commit:           string  -- Source Git commit.
     // src_url:              string  -- Source Git URL.
     // staging_repository:   string  -- Repository URL for the staging repo.
+    // v2s2:                 bool    -- Use docker v2s2 format rather than OCI. Default to false.
 
     def secret = params.get('secret', "");
     def from = params.get('from', "");
     def manifest_digest = ""
     def extra_build_args = params.get('extra_build_args', "");
+    def v2s2 = params.get('v2s2', false);
 
     def digests = build_remote_image(params['arches'], params['src_commit'], params['src_url'], params['staging_repository'],
                                      params['image_tag_staging'], secret, from, extra_build_args)
     stage("Push Manifest") {
-        manifest_digest = push_manifest(digests, params['staging_repository'], params['manifest_tag_staging'])
+        manifest_digest = push_manifest(digests, params['staging_repository'], params['manifest_tag_staging'], v2s2)
     }
     return manifest_digest
 }