Skip to content

GitLab CI/CD Pipeline

What the pipeline does

In one line: it builds and publishes ${REGISTRY_HOST}/${ENTITY_NAMESPACE}/${CI_PROJECT_NAME}:${IMAGE_TAG}.

Today, those placeholders map to:

Placeholder Actual variable used
REGISTRY_HOST HARBOR_HOST
ENTITY_NAMESPACE HARBOR_PROJECT
IMAGE_TAG CI_COMMIT_SHORT_SHA and latest

Pipeline structure

The whole pipeline lives in .gitlab-ci.yml and currently has just one stage, build, with one job — also called build.

The build job, step by step

  • Runs in gcr.io/kaniko-project/executor:debug
  • Disables that image's default entrypoint so Kaniko can be called directly
  • Writes /kaniko/.docker/config.json to authenticate against Harbor, using HARBOR_USERNAME / HARBOR_PASSWORD
  • Builds the image from the project's Dockerfile
  • Pushes it to Harbor with two tags: the commit SHA and latest
/kaniko/executor \
  --context "${CI_PROJECT_DIR}" \
  --dockerfile "Dockerfile" \
  --destination "${HARBOR_HOST}/${HARBOR_PROJECT}/${CI_PROJECT_NAME}:${CI_COMMIT_SHORT_SHA}" \
  --destination "${HARBOR_HOST}/${HARBOR_PROJECT}/${CI_PROJECT_NAME}:latest"

Rules, artifacts, dependencies

Concern What's configured
Branch trigger Only runs on main
Tag-specific rules None
Artifacts None produced
Job dependencies None — it's a single job
Deploy/promotion jobs None — this pipeline only builds and publishes

What's implemented vs. what's not

Implemented:

  • Every build produces an immutable image tagged with the commit SHA
  • Every build on main also refreshes the mutable latest tag

Not implemented yet:

  • Multi-environment deployment (dev / staging / prod)
  • Manual approval gates before publishing
  • A Helm deploy step
  • A dedicated deployment stage

Variables and secrets

Variable Secret? Where it comes from What it's for
HARBOR_HOST No GitLab CI variable Registry hostname
HARBOR_PROJECT No GitLab CI variable Registry namespace/project (maps to ENTITY_NAMESPACE)
HARBOR_USERNAME Yes GitLab CI variable Registry login username
HARBOR_PASSWORD Yes GitLab CI variable Registry login password
CI_PROJECT_NAME No Provided by GitLab Part of the image name
CI_COMMIT_SHORT_SHA No Provided by GitLab The immutable image tag

HARBOR_* variables live in GitLab's CI/CD settings, not in the repository.

Assumption

Deployment happens outside this pipeline. There's no deploy stage or job in .gitlab-ci.yml — Helm deployment is assumed to run separately, elsewhere (see 03-helm-chart-deployment.md).

Sources