k8s: fixup ci and dockerfile

.dockerignore

+/target
+.rocks
+.dockerignore
+.gitlab-ci.yaml
+*.snap
+*.xlog
+__pycache__/
+tmp/

.gitlab-ci.yml

@@ -9,8 +9,6 @@ stages:
   - sign
   - deploy
   - test_rpm
-  - release
-  - docker
 
 workflow:
   # See https://docs.gitlab.com/ee/ci/jobs/job_control.html#avoid-duplicate-pipelines
@@ -23,7 +21,8 @@ workflow:
     - if: $CI_PIPELINE_SOURCE == "web"
 
 variables:
-  BASE_IMAGE: docker-public.binary.picodata.io/picodata-build-base
+  REGISTRY: docker-public.binary.picodata.io
+  BASE_IMAGE: ${REGISTRY}/picodata-build-base
   CARGO_HOME: /shared-storage/picodata/.cargo
   CACHE_PATHS: target .venv
   CACHE_ARCHIVE: /shared-storage/picodata/cache.tar
@@ -125,7 +124,7 @@ test:
     #
     # Tags in `tarantool-sys` and `luajit` submodules are necessary for
     # the build scripts. Without them the job fails.
-    - |
+    - &fetch-tags |
       # Fetch tags
       ci-log-section start "fetch-submodule-tags" Fetching tags for submodules
       for s in tarantool-sys tarantool-sys/third_party/luajit; do
@@ -179,6 +178,40 @@ test:
         echo "Skip saving cache on a non-master branch"
       fi
 
+test-docker:
+  stage: test
+  tags:
+    - shell
+  rules:
+    - if: $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
+      changes:
+        compare_to: master
+        paths:
+          - helm/picodata.Dockerfile
+          - helm/picodata-diag.Dockerfile
+          - .gitlab-ci.yml
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+      when: on_success
+    - # else
+      when: never
+  variables:
+    GIT_DEPTH: 100
+    GIT_STRATEGY: fetch
+    GIT_SUBMODULE_STRATEGY: recursive
+  before_script:
+    - export PATH=docker-build-base:$PATH
+    - *fetch-tags
+  script:
+    - |
+      # Build docker images
+      for image in picodata picodata-diag; do
+        ci-log-section start "test-docker-${image}" Building docker image ${image}
+        docker build \
+          --label GIT_COMMIT=${CI_COMMIT_SHA} \
+          -f helm/${image}.Dockerfile .
+        ci-log-section end "test-docker-${image}"
+      done
+
 .pack:
   tags:
     - shell
@@ -350,6 +383,35 @@ deploy-job:
     - pack-debian
     - sign-rpm-packages
 
+deploy-docker:
+  stage: deploy
+  tags:
+    - shell
+  only:
+    - web
+    - tags
+  variables:
+    GIT_DEPTH: 100
+    GIT_STRATEGY: fetch
+    GIT_SUBMODULE_STRATEGY: recursive
+  before_script:
+    - export PATH=docker-build-base:$PATH
+    - *fetch-tags
+    - mkdir -p $CI_PROJECT_DIR/.docker
+    - echo $DOCKER_AUTH_RW > $CI_PROJECT_DIR/.docker/config.json
+  script:
+    - |
+      # Rebuild and push docker images
+      for image in picodata picodata-diag; do
+        ci-log-section start "deploy-docker-${image}" Building and pushing docker image ${image}
+        docker build \
+          --label GIT_COMMIT=${CI_COMMIT_SHA} \
+          -t ${REGISTRY}/${image}:latest \
+          -f helm/${image}.Dockerfile .
+        docker --config $CI_PROJECT_DIR/.docker push ${REGISTRY}/${image}:latest
+        ci-log-section end "deploy-docker-${image}"
+      done
+
 test_el7:
     stage: test_rpm
     only:
@@ -394,52 +456,3 @@ test_redos:
       - yum install -y picodata
     needs:
       - deploy-job
-
-docker_build:
-  stage: docker
-  tags:
-    - shell
-  rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-      changes:
-        # implies compare_to HEAD~1
-        paths: &helm-changes-paths
-          - helm/**
-          - .gitlab-ci.yml
-    - if: $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH
-      changes:
-        compare_to: master
-        paths: *helm-changes-paths
-    - when: never
-  variables:
-    GIT_DEPTH: 0
-    GIT_STRATEGY: fetch
-    GIT_SUBMODULE_STRATEGY: recursive
-  script:
-    # Build main k8s image
-    - docker build -t docker-public.binary.picodata.io/picodata:latest -f helm/picodata.Dockerfile .
-    # Build diagnostic image
-    - docker build -t docker-public.binary.picodata.io/picodata-diag:latest -f helm/picodata-diag.Dockerfile .
-
-docker_push:
-  stage: docker
-  tags:
-    - shell
-  # only:
-    # - web
-    # - tags
-  variables:
-    GIT_DEPTH: 0
-    GIT_STRATEGY: fetch
-    GIT_SUBMODULE_STRATEGY: recursive
-  before_script:
-    - mkdir -p $CI_PROJECT_DIR/.docker
-    - echo $DOCKER_AUTH_RW > $CI_PROJECT_DIR/.docker/config.json
-  script:
-    - rm -rf ~/.docker
-    # Push main k8s image
-    - docker build -t docker-public.binary.picodata.io/picodata:latest -f helm/picodata.Dockerfile .
-    - docker --config $CI_PROJECT_DIR push docker-public.binary.picodata.io/picodata:latest
-    # Push diagnostic image
-    - docker build -t docker-public.binary.picodata.io/picodata-diag:latest -f helm/picodata-diag.Dockerfile .
-    - docker --config $CI_PROJECT_DIR push docker-public.binary.picodata.io/picodata-diag:latest

helm/picodata.Dockerfile

@@ -5,16 +5,14 @@ RUN dnf -y install dnf-plugins-core \
     && dnf install -y gcc gcc-c++ make cmake git libstdc++-static libtool \
     && dnf clean all
 
-RUN set -e; curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
-    | sh -s -- -y --profile default --default-toolchain 1.65.0 \
-    && export PATH=/root/.cargo/bin:${PATH} \
-    && mkdir /build
+RUN set -e; \
+    curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
+    sh -s -- -y --profile default --default-toolchain 1.65.0
+ENV PATH=/root/.cargo/bin:${PATH}
 
 WORKDIR /build/picodata
-
 COPY . .
-
-RUN make build-release
+RUN cargo build --locked --release
 
 FROM rockylinux:8