[v10.0.x] : ImagePullSecrets: Add GAR secret to image_pull_secret in .drone.yml (#80916)

`ImagePullSecrets`: Add `GAR` secret to `image_pull_secret` in `.drone.yml` (#80912)

* Add GAR secret to image_pull_secret

* Fix starlark fmt

(cherry picked from commit 65104a7efa)

.drone.yml

@@ -5,7 +5,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: pr-verify-drone
 node:
@@ -55,7 +56,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: pr-verify-starlark
 node:
@@ -105,7 +107,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: pr-test-frontend
 node:
@@ -184,7 +187,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: pr-lint-frontend
 node:
@@ -258,7 +262,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: pr-test-backend
 node:
@@ -364,7 +369,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: pr-lint-backend
 node:
@@ -450,7 +456,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: pr-build-e2e
 node:
@@ -732,7 +739,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: pr-integration-tests
 node:
@@ -997,7 +1005,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: pr-docs
 node:
@@ -1071,7 +1080,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: pr-shellcheck
 node:
@@ -1115,7 +1125,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: pr-integration-benchmarks
 node:
@@ -1291,7 +1302,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: main-docs
 node:
@@ -1366,7 +1378,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: main-test-frontend
 node:
@@ -1423,7 +1436,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: main-lint-frontend
 node:
@@ -1475,7 +1489,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: main-test-backend
 node:
@@ -1554,7 +1569,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: main-lint-backend
 node:
@@ -1619,7 +1635,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: main-build-e2e-publish
 node:
@@ -2019,7 +2036,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: main-integration-tests
 node:
@@ -2263,7 +2281,8 @@ depends_on:
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: main-windows
 platform:
@@ -2307,7 +2326,8 @@ depends_on:
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: main-trigger-downstream
 node:
@@ -2390,7 +2410,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: publish-docker-public
 node:
@@ -2496,7 +2517,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: publish-artifacts-public
 node:
@@ -2565,7 +2587,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: publish-npm-packages-public
 node:
@@ -2630,7 +2653,8 @@ depends_on:
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: publish-packages
 node:
@@ -2718,7 +2742,8 @@ depends_on:
 - main-test-backend
 - main-test-frontend
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: rgm-main-prerelease
 node:
@@ -2793,7 +2818,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: release-whatsnew-checker
 node:
@@ -2837,7 +2863,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: release-test-frontend
 node:
@@ -2892,7 +2919,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: release-test-backend
 node:
@@ -2969,7 +2997,8 @@ depends_on:
 - release-test-backend
 - release-test-frontend
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: rgm-tag-prerelease
 node:
@@ -3040,7 +3069,8 @@ clone:
 depends_on:
 - rgm-tag-prerelease
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: rgm-tag-prerelease-windows
 platform:
@@ -3104,7 +3134,8 @@ depends_on:
 - rgm-tag-prerelease
 - rgm-tag-prerelease-windows
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: rgm-tag-verify-prerelease-assets
 node:
@@ -3149,7 +3180,8 @@ depends_on:
 - release-test-backend
 - release-test-frontend
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: rgm-version-branch-prerelease
 node:
@@ -3214,7 +3246,8 @@ clone:
 depends_on:
 - rgm-version-branch-prerelease
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: rgm-prerelease-verify-prerelease-assets
 node:
@@ -3253,7 +3286,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: nightly-test-frontend
 node:
@@ -3306,7 +3340,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: nightly-test-backend
 node:
@@ -3381,7 +3416,8 @@ depends_on:
 - nightly-test-backend
 - nightly-test-frontend
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: rgm-nightly-build
 node:
@@ -3488,7 +3524,8 @@ clone:
 depends_on:
 - rgm-nightly-build
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: rgm-nightly-publish
 node:
@@ -3637,7 +3674,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: testing-test-backend-windows
 platform:
@@ -3689,7 +3727,8 @@ depends_on: []
 environment:
   EDITION: oss
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: integration-tests
 node:
@@ -3913,7 +3952,8 @@ clone:
   disable: true
 depends_on: []
 image_pull_secrets:
-- dockerconfigjson
+- gcr
+- gar
 kind: pipeline
 name: publish-ci-windows-test-image
 platform:
@@ -4352,7 +4392,13 @@ get:
   name: .dockerconfigjson
   path: secret/data/common/gcr
 kind: secret
-name: dockerconfigjson
+name: gcr
+---
+get:
+  name: .dockerconfigjson
+  path: secret/data/common/gar
+kind: secret
+name: gar
 ---
 get:
   name: pat
@@ -4523,6 +4569,6 @@ kind: secret
 name: gcr_credentials
 ---
 kind: signature
-hmac: 484597a84e88b3506ba43e1d14887c89226010d60bde9c4b3a39a73484beb9c2
+hmac: 67aba63b08b53f0314ce220a3912f42e6f3e14f407e6409731db21a75ad916b7
 
 ...

scripts/drone/utils/utils.star

@@ -6,7 +6,11 @@ load(
     "scripts/drone/steps/lib.star",
     "slack_step",
 )
-load("scripts/drone/vault.star", "pull_secret")
+load(
+    "scripts/drone/vault.star",
+    "gar_pull_secret",
+    "gcr_pull_secret",
+)
 
 failure_template = "Build {{build.number}} failed for commit: <https://github.com/{{repo.owner}}/{{repo.name}}/commit/{{build.commit}}|{{ truncate build.commit 8 }}>: {{build.link}}\nBranch: <https://github.com/{{ repo.owner }}/{{ repo.name }}/commits/{{ build.branch }}|{{ build.branch }}>\nAuthor: {{build.author}}"
 
@@ -83,7 +87,7 @@ def pipeline(
             },
         ],
         "depends_on": depends_on,
-        "image_pull_secrets": [pull_secret],
+        "image_pull_secrets": [gcr_pull_secret, gar_pull_secret],
     }
     if environment:
         pipeline.update(

scripts/drone/vault.star

@@ -1,7 +1,8 @@
 """
 This module returns functions for generating Drone secrets fetched from Vault.
 """
-pull_secret = "dockerconfigjson"
+gcr_pull_secret = "gcr"
+gar_pull_secret = "gar"
 drone_token = "drone_token"
 prerelease_bucket = "prerelease_bucket"
 gcp_upload_artifacts_key = "gcp_upload_artifacts_key"
@@ -43,7 +44,8 @@ def secrets():
         vault_secret(gcp_grafanauploads, "infra/data/ci/grafana-release-eng/grafanauploads", "credentials.json"),
         vault_secret(gcp_grafanauploads_base64, "infra/data/ci/grafana-release-eng/grafanauploads", "credentials_base64"),
         vault_secret("grafana_api_key", "infra/data/ci/grafana-release-eng/grafanacom", "api_key"),
-        vault_secret(pull_secret, "secret/data/common/gcr", ".dockerconfigjson"),
+        vault_secret(gcr_pull_secret, "secret/data/common/gcr", ".dockerconfigjson"),
+        vault_secret(gar_pull_secret, "secret/data/common/gar", ".dockerconfigjson"),
         vault_secret("github_token", "infra/data/ci/github/grafanabot", "pat"),
         vault_secret(drone_token, "infra/data/ci/drone", "machine-user-token"),
         vault_secret(prerelease_bucket, "infra/data/ci/grafana/prerelease", "bucket"),