Jenkins - gcp 实例 - 找不到 gcloud-service-account-secret-key.json

Question

i'm building jenkins pipline,one of the steps run's bash script, with few commands:

 *   gcloud --quiet auth configure-docker
 *   docker-compose -f ${DOCKER_COMPOSE_PATH} ${DOCKER_COMPOSE_CACHING_FILE} build ${SERVICE_NAME}

when i tried just running the script in the piplinet

 /var/lib/jenkins/workspace/infrastructure-build/build.sh

i've got an error

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Post http://%2Fvar%2Frun%2Fdocker.sock/v1.40/images/create?fromImage=gcr.io%2Fkycstation-production%2Fzkui&tag=stagingcache : dial unix /var/run/docker.sock: connect: permission denied

so i added "sudo" and than a new error have accured instead:

ERROR: (gcloud.auth.activate-service-account) Could not read json file gcloud-service-account-secret-key.json: No JSON object could be decoded

i have tried the next things: 1. created global variable in jenkins configuration 2. adding docker to root group 3. gcloud init

4. https://cloud.google.com/sdk/docs/quickstart-debian-ubuntu https://cloud.google.com/container-registry/docs/advanced-authentication https://cloud.google.com/container-registry/docs/support/deprecation-notices#gcloud-docker https://cloud.google.com/iam/docs/creating-managing-service-account-keys

surfed the web, and still hadn't find anything that can help me

Answer 1

/var/run/docker.sock: connect: permission denied For this issue, you need to do two things;

1. Adding Jenkins as superuser (to exclude sudo in commands)
   • $ sudo visudo
   • jenkins ALL=(ALL) NOPASSWD:ALL
2. chmod 777 /var/run/docker.sock (to overcome permission issue)

ERROR: (gcloud.auth.activate-service-account)

1. For this issue, before running gcloud commands, include your service account JSON file with appropriate credentials in Jenkins as Secret File.
2. Reference that inside the Jenkinsfile as
   • withCredentials([file(credentialsId: "sa-credentials", variable: 'SA_KEY')]) {
     • sh 'gcloud auth activate-service-account --key-file=${SA_KEY}' }

and then execute other commands.