This is followup from T291978: Limit GitLab shared runners to images from Wikimedia Docker registry. Needs changes in both ops/puppet and cloud runner config.
Capturing this from IRC:
<gmodena> Hi folks, I have a CI pipeline that started failing with ERROR: The "maven:3.3.9-jdk-8" image is not present on list of allowed images. (https://gitlab.wikimedia.org/repos/data-engineering/mediawiki-stream-enrichment/-/jobs/207010). I've seen this error in the past, but it used to go away after a retry. Has the list of allowed images permanently changed? <gmodena> and FWIW using our internal docker image (which i should have done to begin with), triggers a similar error: https://gitlab.wikimedia.org/repos/data-engineering/mediawiki-stream-enrichment/-/jobs/20712 <gmodena> ERROR: The "docker-registry.wikimedia.org/releng/maven-java8:1.0.0-s1" image is not present on list of allowed images: <dancy> gmodena: https://gerrit.wikimedia.org/r/c/operations/puppet/+/724472 was merged on June 9 (last Thursday) which restricted what images can be run. <dancy> The topic is discussed in https://phabricator.wikimedia.org/T291978. That might be a reasonable place for you to request that maven:* be added to the trusted list. <+brennen> gmodena, dancy: that seems like a bug - or at least the internal docker image part of it does - docker-registry.wikimedia.org images should all be allowed. i'll look at this after current meeting. <dduvall> maybe it requires a pattern of more depth, `docker-registry.wikimedia.org/*/*` or `docker-registry.wikimedia.org/**/*`? <dduvall> for the allow list that is <+brennen> yeah, i wonder <+brennen> seems pretty likely <+brennen> https://github.com/bmatcuk/doublestar#patterns
From the doublestar docs:
| Special Terms | Meaning |
|---|---|
| * | matches any sequence of non-path-separators |
| /**/ | matches zero or more directories |
| ? | matches any single non-path-separator character |
| [class] | matches any single non-path-separator character against a class of characters (see "character classes") |
| {alt1,...} | matches a sequence of characters if one of the comma-separated alternatives matches |
So it does look like we need to add /**/ to include paths with a directory separator.