如何为OpenShift S2I二进制构建的镜像添加动态标签？

Great question! Let's walk through better alternatives to your current oc set env workflow for adding dynamic labels (like commit hashes or branch names) to OpenShift S2I binary builds—including options that don’t require modifying your Dockerfile.

Option 1: Parameterized BuildConfigs with Dynamic Output Tags #

This approach lets you set dynamic image tags directly in your BuildConfig without touching your Dockerfile, and uses build parameters to inject values at build time.

First, update your BuildConfig to use parameterized output tags and define required parameters:

apiVersion: build.openshift.io/v1
kind: BuildConfig
metadata:
  name: my-s2i-build
spec:
  output:
    # Use a template for the tag, populated by build parameters
    to:
      kind: ImageStreamTag
      name: "my-app-image:${COMMIT_HASH}"
  strategy:
    sourceStrategy:
      from:
        kind: ImageStreamTag
        name: "your-s2i-builder:latest"
  # Define parameters for dynamic values
  parameters:
    - name: COMMIT_HASH
      description: Short Git commit hash for the build
      required: true
    - name: BRANCH_NAME
      description: Git branch name for the build
      required: true

Then start your binary build with the parameters populated from your local Git repo:

oc start-build my-s2i-build \
  --binary \
  --path ./your-app-source \
  --param COMMIT_HASH=$(git rev-parse --short HEAD) \
  --param BRANCH_NAME=$(git rev-parse --abbrev-ref HEAD)

This will create an image tagged with your commit hash (e.g., my-app-image:abc123) automatically. If you also want to add metadata labels to the image itself (not just the tag), see Option 2.

Option 2: Use S2I Builder Environment Variables for Image Metadata Labels #

Many official S2I builder images support environment variables that let you inject custom metadata labels into the final image—no Dockerfile changes needed.

Update your BuildConfig to use environment variables tied to build parameters:

spec:
  strategy:
    sourceStrategy:
      from:
        kind: ImageStreamTag
        name: "your-s2i-builder:latest"
      env:
        # Pass comma-separated key=value pairs to add as image labels
        - name: IMAGE_LABELS
          value: "commit=${COMMIT_HASH},branch=${BRANCH_NAME}"
  parameters:
    - name: COMMIT_HASH
      required: true
    - name: BRANCH_NAME
      required: true

Then start the build the same way as Option 1. The S2I builder will automatically add these labels to your final image (you can verify with oc describe imagestreamtag my-app-image:abc123).

Option 3: Post-Build Hook for Tagging #

If you want to keep your BuildConfig simple and just add dynamic tags after the build completes, use a post-build hook:

spec:
  postCommit:
    # Tag the built image with the commit hash
    script: |
      oc tag my-app-image:latest my-app-image:${COMMIT_HASH}
  parameters:
    - name: COMMIT_HASH
      required: true

This runs a script after the build finishes to create a new tag for your image using the commit hash parameter.

Does S2I support passing --label directly to docker build? #

Short answer: Not directly via oc start-build flags, but the workarounds above achieve the same result. Under the hood, S2I uses buildah or docker build to create the image, and it handles label injection via builder-specific environment variables (like IMAGE_LABELS mentioned in Option 2) or by processing the builder image's assemble scripts. If you’re using a custom S2I builder, you could modify its assemble script to accept label arguments and pass them to the build command, but that’s more involved than the options above.

Why these are better than your current workflow #

Your current oc set env approach modifies the BuildConfig itself, which can lead to unintended side effects for subsequent builds (if you forget to reset the environment variables). Parameterized builds keep dynamic values isolated to each build run, making your pipeline more predictable and repeatable.

内容的提问来源于stack exchange，提问作者csviri