ARTIFACTORY: How to Deploy Docker images from Gitlab using Artifactory OIDC integration

This article will guide you through the steps to establish a JFrog Platform OIDC integration between the JFrog Platform and Gitlab with a Gitlab build pipeline Job that uses the JFrog CLI.

To create a Gitlab OIDC Integration

1. Navigate to the Administration tab In the JFrog Platform UI
2. Click General Management > Manage Integrations
3. Click New Integration, and select OpenID Connect from the drop-down menu and enter the necessary information.
4. Copy the “Provider name” and “Audience” name to use it in the build.
5. In the Identity mappings, enter Claims and priority. The priority 1 will have the top priority.
6. In the Claims JSON field, enter the identity mapping according to the token claims you want to match.

 For example: 

{
 "project_path": [
   "myorgtest/oidc-test-jfrog",
   "myorgtest/oidc-docker-jfrog"
 ]
}

Sample JFrog OIDC Integration:

 





To create a pipeline Job in Gitlab

1. Login into Gitlab and Navigate to the Projects → Select the Project
2. Under the Build → Pipeline Editor → Write your own(if it is a new pipeline)
3. Add the pipeline script and commit changes
   

To add the Project Variables for your pipeline:

1. Go to Settings → CICD → Project Variables
2. Add the below Variables to avoid exposing the values in the pipeline

DOCKER_REGISTRY → my-docker-virtual.mycompany.com
JF_URL → https://mycompany.com

To generate the ID token for the OIDC connectivity, use the pipeline snippet below:

 id_tokens:
    JFROG_CLI_OIDC_EXCHANGE_TOKEN_ID:
      aud: jfrog-gitlab

To authenticate the JFrog CLI with the OIDC token, configure the JFrog CLI config as follows:

     jf c add artifactory-server --url "$JF_URL" --oidc-provider-name=shis-gitlab-oidc --interactive=false

Sample Gitlab Pipeline Script:

This pipeline script deploys a docker image with buildinfo to the Artifactory Docker repository. The OIDC token is mapped with a Project role using Identity mapping as seen in the Token scope of the above provided screenshot.

image: docker:24.0.2   # docker CLI

services:
  - docker:24.0.2-dind  # Docker daemon inside CI
  
stages:
  - build

variables:
  DOCKER_TLS_CERTDIR: "/certs"  # required for docker:dind
  BUILD_NAME: "jfrog-gitlab-docker-build"
  BUILD_NUMBER: "$CI_PIPELINE_ID"
  JFROG_CLI_OFFER_CONFIG: "false"
  JFROG_CLI_LOG_LEVEL: INFO

before_script:
  - apk add --no-cache curl

jf-cli-job:
  stage: build
  id_tokens:
    JFROG_CLI_OIDC_EXCHANGE_TOKEN_ID:
      aud: jfrog-gitlab
  script:
    - echo "Installing JFrog CLI as 'jf'..."
    - curl -fL https://getcli.jfrog.io/v2 | sh
    - chmod +x jfrog
    - mv jfrog /usr/local/bin/jf
    - jf --version
    - |
      jf c add artifactory-server --url "$JF_URL" --oidc-provider-name=shis-gitlab-oidc --interactive=false
      jf config use artifactory-server
      docker pull busybox
      jf docker tag busybox $DOCKER_REGISTRY/busybox-jfrog 
      jf docker push $DOCKER_REGISTRY/busybox-jfrog --project=shis --build-name=docker-builds --build-number=$CI_PIPELINE_ID
      # Ping Artifactory
      jf rt ping
      # Collect environment variables for the build
      jf rt bce docker-builds $CI_PIPELINE_ID
      # Collect VCS details from git and add them to the build
      jf rt bag docker-builds $CI_PIPELINE_ID --project=shis
      # Publish build info
      jf rt bp docker-builds $CI_PIPELINE_ID --project=shis

      # Publish build info
      jf rt bp $BUILD_NAME  $BUILD_NUMBER --project=shis

A snippet of the Docker image deployed in the Artifactory:

 


Reference:
https://jfrog.com/help/r/jfrog-platform-administration-documentation/configure-jfrog-oidc-integration-with-gitlab