Connect GitLab CI

Point a kaniko build on GitLab CI at this backend.

Four steps. Nothing is stored in your repository: the job mints a short-lived token per build.

1. Sign in

2. Ask for your namespace

The access page lists the namespaces GitLab reports for you. Request the one your project sits under and wait for an admin to approve it.

If the project lives in a subgroup, request the subgroup. A build's token names the project's immediate parent, so approving the parent group does not cover it.

3. Add the build job

Put this in .gitlab/kaniko.yml, include: it, and extends: .kaniko-build from any job that builds an image. Already have a kaniko job? The + lines are all it needs.

# The account these builds belong to comes from the token below, not from
# anything set here.
.kaniko-build:
  image:
    name: ghcr.io/osscontainertools/kaniko:v1.28.5-debug
    entrypoint: [""]
  id_tokens:
    KANIKO_TELEMETRY_ID_TOKEN:
      aud: kaniko-telemetry
  variables:
    KANIKO_TELEMETRY_ENDPOINT: "https://152.70.24.68.sslip.io/oidc/v1/traces"
    KANIKO_TELEMETRY_TOKEN_EXCHANGE_ENDPOINT: "https://152.70.24.68.sslip.io/ingest/token"
    DOCKERFILE: Dockerfile
    CONTEXT_PATH: .
    IMAGE_URL: $CI_REGISTRY_IMAGE
    IMAGE_NAME: ""
    IMAGE_TAG: latest
    BASE_ARGS: >-
      --dockerfile $DOCKERFILE
      --context $CONTEXT_PATH
      --destination=${IMAGE_URL}/${IMAGE_NAME}:${IMAGE_TAG}${EXT}
    BUILD_ARGS: ""
    CACHE: "true"
    CACHE_REPO: "${CI_REGISTRY_IMAGE}/cache"
    CACHE_ARGS: >-
      --cache=$CACHE
      --cache-copy-layers
      --cache-repo $CACHE_REPO
    EXTRA_ARGS: ""
  script:
    - set -x
    - /kaniko/executor
      $BASE_ARGS
      $BUILD_ARGS
      $CACHE_ARGS
      $EXTRA_ARGS
    - echo IMAGE_ID=${IMAGE_URL}/${IMAGE_NAME}:${IMAGE_TAG}${EXT} > image.env
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      variables:
        EXT: ""
    - if: $CI_MERGE_REQUEST_ID
      variables:
        EXT: -MR${CI_MERGE_REQUEST_IID}
    - variables:
        EXT: -${CI_COMMIT_REF_SLUG}
  artifacts:
    reports:
      dotenv: image.env

4. Run a pipeline

The build appears under Builds a few seconds after the job finishes.

A refused exchange logs ingest token exchange refused and the build carries on without telemetry.

What the snippet does

GitLab hands the job an identity token, kaniko trades it for an ingest token and sends that with its spans. The token lasts minutes and never leaves the job that asked for it.

Which account the build belongs to comes from that identity, not from anything the pipeline sets.

If nothing arrives

Check the job log for exchange refused, and check the picker above matches the kaniko you run. The endpoint differs between versions and the wrong one fails silently.