Spring Boot Maven Plugin - Publish latest tag by default when using a custom image name

[dja557]

Spring Boot Maven Plugin - Publish latest tag by default when using a custom image name

[scottfrederick]

Thanks for the suggestion.

I can't think of a reason why we wouldn't want publishing an updated latest tag to be the default behavior.

I don't think that all users would agree with this. If images are being built and published from a CI pipeline, you may not want latest to be updated with every build, but instead you might want to explicitly decide when to promote a build to latest. Changing the default behavior like this could be quite a surprise for many users.

If we want to make it optional, we could even provide a new flag such as image.publishLatest

With the current functionality, if you wanted to always publish a latest along with the versioned tag, you would do something like this:

<project>
  <build>
    <plugins>
      <plugin>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-maven-plugin</artifactId>
        <configuration>
          <image>
            <name>example.com/library/${project.artifactId}:${project.version}</name>
            <tags>
              <tag>example.com/library/${project.artifactId}:latest</tag>
            <tags>
            <publish>true</publish>
          </image>
        </configuration>
      </plugin>
    </plugins>
  </build>
</project>

A new option like image.publishLatest would eliminate the need for the <tags></tags> section, but in a much less flexible way. I don't think implementing a new, less flexible, option to replace something that can already be done has value. I also would not want to combine the behavior of the <publish>true</publish> option and a tagging option into one new option.

Are you doing something different from this <tags></tags> example now, or do you find this configuration too verbose?

[dja557]

@scottfrederick - I guess my question would be, what is the recommended approach to do this via the command line in CI when we need to set a custom tag name and also publish an updated latest tag while also having to pass credentials to authenticate to the docker registry?

[scottfrederick]

We typically don't expose the more complex and/or nested option types as command-line parameters for Maven plugin goals (including env, buildpacks, bindings, and tags for spring-boot:build-image). I think we added support for docker.publishRegistry.username and docker.publishRegistry.password as command-line options because it is likely that these contain sensitive information that you would not want to hard-code in pom.xml.

If you need to set tags or other options conditionally, the recommended approach is to use Maven profiles and activate the appropriate profile from the command line using mvn -P <profileName>.

[dja557]

@scottfrederick - Thanks for the feedback. I'd say that since Spring Boot is built for the enterprise and large-scale business use-cases that typically have private docker registries, I'd recommend adding the image.tags option as a command-line parameter so that it can be set via CI at build/publish time. Also, it would be great to be able to set the docker.publishRegistry.* parameters without having to manually pipe them into the pom.xml as mentioned here since we have to regularly pull these secrets from an external secrets store or GitHub Actions.

I was able to workaround these constraints by doing the following. Hopefully this helps someone if they're encountering the same issue.

pom.xml

<plugin>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-maven-plugin</artifactId>
    <configuration>
    <docker>
        <publishRegistry>
            <username>${docker.publishRegistry.username}</username>
            <password>${docker.publishRegistry.password}</password>
        </publishRegistry>
    </docker>
    <image>
        <tags>
            <tag>docker.artifactory.xyz.com/my_image:latest</tag>
        </tags>
    </image>
    </configuration>
</plugin>

CLI Command

mvn spring-boot:build-image \
     -Dmaven.test.skip=true \
     -Ddocker.publishRegistry.username=username \
     -Ddocker.publishRegistry.password=password \
     -Dspring-boot.build-image.publish=true \
     -Dspring-boot.build-image.imageName=docker.artifactory.xyz.com/my_image:generated_image_tag

[scottfrederick]

@dja557 The technique that you've shown here is very similar to what we recommend in our documentation for overriding Maven configuration properties on the command line. In the case of credentials like these, I think it is more likely that the values will be environment variables populated by a CI system from a secrets store rather than command-line parameters.

We appreciate the feedback and suggestions, but I don't think we want to do anything more here.