Support '--ssh' option in 'docker build'

docs/content/en/schemas/v2beta10.json

@@ -1011,6 +1011,11 @@
           "description": "contains information about a local secret passed to `docker build`, along with optional destination information.",
           "x-intellij-html-description": "contains information about a local secret passed to <code>docker build</code>, along with optional destination information."
         },
+        "ssh": {
+          "type": "string",
+          "description": "used to pass in --ssh to docker build to use SSH agent. Format is \"default|<id>[=<socket>|<key>[,<key>]]\".",
+          "x-intellij-html-description": "used to pass in --ssh to docker build to use SSH agent. Format is &quot;default|<id>[=<socket>|<key>[,<key>]]&quot;."
+        },
         "target": {
           "type": "string",
           "description": "Dockerfile target name to build.",
@@ -1024,7 +1029,8 @@
         "network",
         "cacheFrom",
         "noCache",
-        "secret"
+        "secret",
+        "ssh"
       ],
       "additionalProperties": false,
       "description": "describes an artifact built from a Dockerfile, usually using `docker build`.",

integration/testdata/build/ssh/Dockerfile

@@ -0,0 +1,6 @@
+# syntax=docker/dockerfile:1.0.0-experimental
+
+FROM alpine:3.10
+
+# https://github.com/tonistiigi/buildkit/blob/1604b1b9ed70bcbc002033d8dd0e65ab13f13554/client/llb/exec.go#L138
+RUN --mount=type=ssh ls /run/buildkit/ssh_agent.*

integration/testdata/build/ssh/skaffold.yaml

@@ -0,0 +1,10 @@
+apiVersion: skaffold/v2beta10
+kind: Config
+build:
+  local:
+    useBuildkit: true
+    push: false
+  artifacts:
+  - image: ssh
+    docker:
+      ssh: "default"

pkg/skaffold/build/gcb/docker.go

@@ -64,8 +64,8 @@ func (b *Builder) cacheFromSteps(artifact *latest.DockerArtifact) []*cloudbuild.
 func (b *Builder) dockerBuildArgs(a *latest.Artifact, tag string, deps []*latest.ArtifactDependency) ([]string, error) {
 	d := a.DockerArtifact
 	// TODO(nkubala): remove when buildkit is supported in GCB (#4773)
-	if d.Secret != nil {
-		return nil, errors.New("docker build secrets not currently supported in GCB builds")
+	if d.Secret != nil || d.SSH != "" {
+		return nil, errors.New("docker build options, secrets and ssh, are not currently supported in GCB builds")
 	}
 	requiredImages := docker.ResolveDependencyImages(deps, b.artifactStore, true)
 	buildArgs, err := docker.EvalBuildArgs(b.cfg.Mode(), a.Workspace, d.DockerfilePath, d.BuildArgs, requiredImages)

pkg/skaffold/build/gcb/docker_test.go

@@ -104,7 +104,7 @@ func TestDockerBuildSpec(t *testing.T) {
 			},
 		},
 		{
-			description: "buildkit features not supported in GCB",
+			description: "buildkit `secret` option not supported in GCB",
 			artifact: &latest.Artifact{
 				ArtifactType: latest.ArtifactType{
 					DockerArtifact: &latest.DockerArtifact{
@@ -117,6 +117,18 @@ func TestDockerBuildSpec(t *testing.T) {
 			},
 			shouldErr: true,
 		},
+		{
+			description: "buildkit `ssh` option not supported in GCB",
+			artifact: &latest.Artifact{
+				ArtifactType: latest.ArtifactType{
+					DockerArtifact: &latest.DockerArtifact{
+						DockerfilePath: "Dockerfile",
+						SSH:            "default",
+					},
+				},
+			},
+			shouldErr: true,
+		},
 	}
 
 	for _, test := range tests {

pkg/skaffold/docker/image.go

@@ -167,8 +167,8 @@ func (l *localDaemon) ConfigFile(ctx context.Context, image string) (*v1.ConfigF
 }
 
 func (l *localDaemon) CheckCompatible(a *latest.DockerArtifact) error {
-	if a.Secret != nil {
-		return fmt.Errorf("docker build secrets require BuildKit - set `useBuildkit: true` in your config, or run with `DOCKER_BUILDKIT=1`")
+	if a.Secret != nil || a.SSH != "" {
+		return fmt.Errorf("docker build options, secrets and ssh, require BuildKit - set `useBuildkit: true` in your config, or run with `DOCKER_BUILDKIT=1`")
 	}
 	return nil
 }
@@ -510,6 +510,10 @@ func ToCLIBuildArgs(a *latest.DockerArtifact, evaluatedArgs map[string]*string)
 		args = append(args, "--secret", secretString)
 	}
 
+	if a.SSH != "" {
+		args = append(args, "--ssh", a.SSH)
+	}
+
 	return args, nil
 }
 

pkg/skaffold/docker/image_test.go

@@ -354,6 +354,13 @@ func TestGetBuildArgs(t *testing.T) {
 			},
 			want: []string{"--secret", "id=mysecret,src=foo.src,dst=foo.dst"},
 		},
+		{
+			description: "ssh with no source",
+			artifact: &latest.DockerArtifact{
+				SSH: "default",
+			},
+			want: []string{"--ssh", "default"},
+		},
 		{
 			description: "all",
 			artifact: &latest.DockerArtifact{

pkg/skaffold/schema/latest/config.go

@@ -1125,6 +1125,9 @@ type DockerArtifact struct {
 	// Secret contains information about a local secret passed to `docker build`,
 	// along with optional destination information.
 	Secret *DockerSecret `yaml:"secret,omitempty"`
+
+	// SSH is used to pass in --ssh to docker build to use SSH agent. Format is "default|<id>[=<socket>|<key>[,<key>]]".
+	SSH string `yaml:"ssh,omitempty"`
 }
 
 // DockerSecret contains information about a local secret passed to `docker build`,