Build image-builder in ado. (kyma-project#9538)

* Update image building rules and add post-build job (kyma-project#9461) Updated the 'run_if_changed' patterns in the 'images.yaml' file for more precise reaction to changes. Furthermore, '--export-tags' option was removed for building image-builder as tags are not used in build process. A post-build job for image-builder was added. Now, every time changes are detected in the specified paths in 'main' branch, the image-builder image will be built automatically. This reduces manual effort and ensures that the latest code changes are incorporated in the image-builder. * Allow admins to bypass branch protection in community-modules (kyma-project#9437) * Remove unused script from Istio reconciler testing (kyma-project#9468) * Tag telemetry-manager image with module version and remove release job (kyma-project#9456) * tag telemetry-manager image with module version and remove release job * tag telemetry-manager image with module version in a separate job * change job name * add auto-generated empty line * job_removed (kyma-project#9471) * gomod(deps): bump google.golang.org/api from 0.152.0 to 0.153.0 (kyma-project#9474) Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.152.0 to 0.153.0. - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.152.0...v0.153.0) --- updated-dependencies: - dependency-name: google.golang.org/api dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * actions(deps): bump actions/setup-go from 4 to 5 (kyma-project#9476) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4 to 5. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@v4...v5) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docker-rotate-sa(deps): bump golang (kyma-project#9477) Bumps golang from 1.21.4-alpine3.17 to 1.21.5-alpine3.17. --- updated-dependencies: - dependency-name: golang dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bumping test-infra and testimages and test-infra-prod (kyma-project#9479) No eu.gcr.io/kyma-project/test-infra/ changes. No europe-docker.pkg.dev/kyma-project/prod/testimages/ changes. Multiple distinct europe-docker.pkg.dev/kyma-project/prod/test-infra/ changes: Commits | Dates | Images --- | --- | --- kyma-project/test-infra@e65a3f7...ba72d49 | 2023‑12‑04 → 2023‑12‑06 | prod/test-infra/ko/clusterscollector, prod/test-infra/ko/cors-proxy, prod/test-infra/ko/diskscollector, prod/test-infra/ko/dnscollector, prod/test-infra/ko/externalsecretschecker, prod/test-infra/ko/gardener-rotate, prod/test-infra/ko/gcscleaner, prod/test-infra/ko/github-webhook-gateway, prod/test-infra/ko/image-detector, prod/test-infra/ko/image-syncer, prod/test-infra/ko/image-url-helper, prod/test-infra/ko/ipcleaner, prod/test-infra/ko/markdown-index, prod/test-infra/ko/move-gcs-bucket, prod/test-infra/ko/needs-tws, prod/test-infra/ko/orphanremover, prod/test-infra/ko/pjtester, prod/test-infra/ko/scan-logs-for-secrets, prod/test-infra/ko/search-github-issue, prod/test-infra/ko/usersmapchecker, prod/test-infra/ko/vmscollector kyma-project/test-infra@57f98c4...ba72d49 | 2023‑12‑04 → 2023‑12‑06 | prod/test-infra/slackmessagesender * move-gcs-bucket(deps): bump golang in /cmd/cloud-run/move-gcs-bucket (kyma-project#9480) Bumps golang from 1.21.4-alpine3.17 to 1.21.5-alpine3.17. --- updated-dependencies: - dependency-name: golang dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * gomod(deps): bump github.com/spf13/viper from 1.17.0 to 1.18.0 (kyma-project#9475) Bumps [github.com/spf13/viper](https://github.com/spf13/viper) from 1.17.0 to 1.18.0. - [Release notes](https://github.com/spf13/viper/releases) - [Commits](spf13/viper@v1.17.0...v1.18.0) --- updated-dependencies: - dependency-name: github.com/spf13/viper dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ginkgo(deps): bump golang in /prow/images/ginkgo (kyma-project#9478) Bumps golang from 1.21.4-alpine3.17 to 1.21.5-alpine3.17. --- updated-dependencies: - dependency-name: golang dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bumping test-infra and testimages and test-infra-prod (kyma-project#9481) No eu.gcr.io/kyma-project/test-infra/ changes. europe-docker.pkg.dev/kyma-project/prod/testimages/ changes: kyma-project/test-infra@57f98c4...59f0cdf (2023‑12‑04 → 2023‑12‑06) europe-docker.pkg.dev/kyma-project/prod/test-infra/ changes: kyma-project/test-infra@ba72d49...37d4a17 (2023‑12‑06 → 2023‑12‑06) * Bumping sec-scanners-config.yaml (kyma-project#9458) * Bumping test-infra and testimages and test-infra-prod (kyma-project#9482) No eu.gcr.io/kyma-project/test-infra/ changes. No europe-docker.pkg.dev/kyma-project/prod/testimages/ changes. europe-docker.pkg.dev/kyma-project/prod/test-infra/ changes: kyma-project/test-infra@37d4a17...f9e8ceb (2023‑12‑06 → 2023‑12‑06) * Bump natsio images (kyma-project#9469) * Remove the eventing manager template. (kyma-project#9484) * Use semantic versioning for eventing manager (kyma-project#9473) * Use semantic versioning for eventing manager * Restore template * Adds a setting to ignore non-required tide contexts (kyma-project#9485) * fix run_if_changed (kyma-project#9487) * chore: Remove cli related k3d pipelines that use kyma deploy (kyma-project#9486) * chore: Remove cli related e2e test that use kyma deploy * cleanup templates * cleanup templates * revert integration * Ignore docker images based on regexp (kyma-project#9488) * Ignore docker images based on regexp * Update cloud run config as well * Bumping sec-scanners-config.yaml (kyma-project#9483) * add two missing required job (kyma-project#9489) * allow post build job to run on release-* branches for eventing-manager (kyma-project#9498) * allow post build job to run on release-* branches for eventing-manager * remove skip instruction * add formatting and add release branch instruction * docker-rotate-sa(deps): bump alpine (kyma-project#9500) Bumps alpine from 3.18.5 to 3.19.0. --- updated-dependencies: - dependency-name: alpine dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * gomod(deps): bump github.com/spf13/viper from 1.18.0 to 1.18.1 (kyma-project#9501) Bumps [github.com/spf13/viper](https://github.com/spf13/viper) from 1.18.0 to 1.18.1. - [Release notes](https://github.com/spf13/viper/releases) - [Commits](spf13/viper@v1.18.0...v1.18.1) --- updated-dependencies: - dependency-name: github.com/spf13/viper dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * move-gcs-bucket(deps): bump alpine in /cmd/cloud-run/move-gcs-bucket (kyma-project#9502) Bumps alpine from 3.18.5 to 3.19.0. --- updated-dependencies: - dependency-name: alpine dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bumping test-infra and testimages and test-infra-prod (kyma-project#9503) No eu.gcr.io/kyma-project/test-infra/ changes. No europe-docker.pkg.dev/kyma-project/prod/testimages/ changes. Multiple distinct europe-docker.pkg.dev/kyma-project/prod/test-infra/ changes: Commits | Dates | Images --- | --- | --- kyma-project/test-infra@f9e8ceb...e0b1571 | 2023‑12‑06 → 2023‑12‑08 | prod/test-infra/ko/clusterscollector, prod/test-infra/ko/cors-proxy, prod/test-infra/ko/diskscollector, prod/test-infra/ko/dnscollector, prod/test-infra/ko/externalsecretschecker, prod/test-infra/ko/gardener-rotate, prod/test-infra/ko/gcscleaner, prod/test-infra/ko/github-webhook-gateway, prod/test-infra/ko/image-detector, prod/test-infra/ko/image-syncer, prod/test-infra/ko/image-url-helper, prod/test-infra/ko/ipcleaner, prod/test-infra/ko/markdown-index, prod/test-infra/ko/move-gcs-bucket, prod/test-infra/ko/needs-tws, prod/test-infra/ko/orphanremover, prod/test-infra/ko/pjtester, prod/test-infra/ko/scan-logs-for-secrets, prod/test-infra/ko/search-github-issue, prod/test-infra/ko/usersmapchecker, prod/test-infra/ko/vmscollector kyma-project/test-infra@37d4a17...e0b1571 | 2023‑12‑06 → 2023‑12‑08 | prod/test-infra/slackmessagesender * Bumping sec-scanners-config.yaml (kyma-project#9504) * Bumping Prow (kyma-project#9506) europe-docker.pkg.dev/kyma-project/prod/k8s-prow/ changes: kyma-project/k8s-prow@274dc2b...0438486 (2023‑12‑04 → 2023‑12‑11) * check for valid serverless CR URL (kyma-project#9507) * stop running the post manager build job on release branches (kyma-project#9509) * removed jobs of directory-size-exporter (kyma-project#9499) * reconciler consistently failing - expected and can be ignored (kyma-project#9510) * slack-msg-sender(deps): bump python (kyma-project#9513) Bumps python from 3.12.0-alpine3.18 to 3.12.1-alpine3.18. --- updated-dependencies: - dependency-name: python dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bumping test-infra and testimages and test-infra-prod (kyma-project#9514) No eu.gcr.io/kyma-project/test-infra/ changes. No europe-docker.pkg.dev/kyma-project/prod/testimages/ changes. europe-docker.pkg.dev/kyma-project/prod/test-infra/ changes: kyma-project/test-infra@e0b1571...e0cf65a (2023‑12‑08 → 2023‑12‑11) * Bumping sec-scanners-config.yaml (kyma-project#9515) * tf(deps): bump hashicorp/google in /configs/terraform/core (kyma-project#9512) Bumps [hashicorp/google](https://github.com/hashicorp/terraform-provider-google) from 5.8.0 to 5.9.0. - [Release notes](https://github.com/hashicorp/terraform-provider-google/releases) - [Changelog](https://github.com/hashicorp/terraform-provider-google/blob/main/CHANGELOG.md) - [Commits](hashicorp/terraform-provider-google@v5.8.0...v5.9.0) --- updated-dependencies: - dependency-name: hashicorp/google dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Add required status check for KEB (kyma-project#9505) * add squash config for epp repository (kyma-project#9516) * Remove skr-aws-ugrade-integration test (kyma-project#9518) * remove epp, eventing-tools, eventing-module jobs (kyma-project#9517) * Fix image building (kyma-project#9519) * Fix image building * apply suggestions * fix cahngelog generator * Bumping test-infra and testimages and test-infra-prod (kyma-project#9520) No eu.gcr.io/kyma-project/test-infra/ changes. No europe-docker.pkg.dev/kyma-project/prod/testimages/ changes. europe-docker.pkg.dev/kyma-project/prod/test-infra/ changes: kyma-project/test-infra@fdb47ca...9bb59ac (2023‑08‑21 → 2023‑12‑12) * Bumping sec-scanners-config.yaml (kyma-project#9521) * Add ADO pipeline preview run feature and test (kyma-project#9462) * Add sign-only mode. * POC of image building in ADO. * go mod tidy * Use default build config. * POC of image building in ADO. * Use default build config. * fix linter errors * rendertemplates * Move ado code to separate pacakge and make it testable. * Move build in ado code to separate package. This can be tested independent and reused in other tools. * Tests. TODOs for needed improvements. Comments. Small changes in code. * go mod tidy * Added building image-builder image to the prowjob. * Use go buildpack. Chainguard offers free access to the latest tag only. * Moved Dockerfile back to original location. images directory is not suitable for building image-builder. * Unexport options fields. * Remove testing prowjob. * Add preview run flag. * Add ADO pipeline preview run feature and test Added a feature in the image builder that allows ADO (Azure DevOps) pipeline to run in preview mode. This allows users to see the final YAML of the pipeline before executing it. The use of this option can be flagged with adoPreviewRun and it has been limited to work only when running in ADO and not locally. Made companion changes to the tests for these features ensuring all new code is covered. This addition was made to aid debug and development efforts by providing more comprehensive information about pipeline executions in ADO. * package not used in image-builder * File committed by mistake. * go mod tidy * Pull number should be expect only for presubmit job types. * Print exit code in new line. * Align with naming standard. * Add error handling for nil final yaml in ADO pipeline preview run This update adds an error message when the final yaml in the Azure DevOps (ADO) pipeline preview run is nil. This handling is necessary to give clearer feedback when the pipeline preview run fails due to a nil final yaml and to prevent runtime errors. * Add preview run option for Azure DevOps pipelines Refactored the Azure DevOps pipeline trigger functionality to support a "preview run" mode where users can see the generated pipeline yaml before running the actual pipeline. This feature is useful in creating or troubleshooting pipelines in Azure DevOps as it enables users to verify and adjust the yaml configuration before executing a pipeline run. This reduces the risk of pipeline failures due to misconfigurations. Added a new flag that allows the user to specify the path of a yaml file that contains the pipeline definition for the preview run. Made necessary changes in cmd/image-builder/main.go and pkg/azuredevops/pipelines/pipelines.go. Also modified some tests to accommodate these changes and ensure the functionality is working as expected in both preview run and standard run modes. * Review comments. * Added missing negation. Aligned variable name in if condition. * Add skr-trial-suspension-dev prowjob (kyma-project#9524) * Bumping test-infra and testimages and test-infra-prod (kyma-project#9525) No eu.gcr.io/kyma-project/test-infra/ changes. No europe-docker.pkg.dev/kyma-project/prod/testimages/ changes. europe-docker.pkg.dev/kyma-project/prod/test-infra/ changes: kyma-project/test-infra@e0b1571...b563bbe (2023‑12‑08 → 2023‑12‑13) * Bumping sec-scanners-config.yaml (kyma-project#9526) * Adopt nats prow jobs for release flow. (kyma-project#9511) * Remove the old template, as it is no longer needed. * Run post-nats-manager-build-job on main only. * Change the tag for the release-manager-build job to the PULL_BASE_REF. This is the value we pass from here: https://github.com/kyma-project/eventing-manager/blob/2036473ea3a9ae0a93a8d8e6cce65a297b5b4947/.github/workflows/create-release.yml#L63 * Add release-manger-build job to pjtester. * Change PR. * Change PR. * remove pjtester * add e2e-dind-nodejs-20 image with node 20.10 (kyma-project#9529) * add e2e-dind-nodejs-20 image with node 20.10 * cp test.sh * cp init.sh * fix: Increase resources requests for cli release jobs (kyma-project#9530) * post-main-unstable-cli * remove limit * increase resource requests for release job as well * fix: Set resources limits for cli release jobs (kyma-project#9534) * post-main-unstable-cli * remove limit * increase resource requests for release job as well * fix: Set limits for cli release jobs * Bumping test-infra and testimages and test-infra-prod (kyma-project#9531) No eu.gcr.io/kyma-project/test-infra/ changes. europe-docker.pkg.dev/kyma-project/prod/testimages/ changes: kyma-project/test-infra@59f0cdf...751c5f9 (2023‑12‑06 → 2023‑12‑15) No europe-docker.pkg.dev/kyma-project/prod/test-infra/ changes. * Bumping sec-scanners-config.yaml (kyma-project#9535) * Bumping test-infra and testimages and test-infra-prod (kyma-project#9536) No eu.gcr.io/kyma-project/test-infra/ changes. No europe-docker.pkg.dev/kyma-project/prod/testimages/ changes. europe-docker.pkg.dev/kyma-project/prod/test-infra/ changes: kyma-project/test-infra@b563bbe...80c2f22 (2023‑12‑13 → 2023‑12‑15) * Bumping sec-scanners-config.yaml (kyma-project#9537) * Using image-builder image build in CI system. Building new image-builder images using ado backend. * Test building images locally with image-builder build in CI. * rendertemplate * Building in ADO requires access to ado pat. Secure access to ado pat to allow access for image-builder with build-in-ado set to true. Allow pods using image-builder image build in CI to access signify secret. --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Piotr Bochyński <[email protected]> Co-authored-by: Tim Riffer <[email protected]> Co-authored-by: Mostafa Shorim <[email protected]> Co-authored-by: Andrzej Pankowski <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Kyma Bot <[email protected]> Co-authored-by: Carina Kothe <[email protected]> Co-authored-by: Friedrich <[email protected]> Co-authored-by: Tibor Kiss <[email protected]> Co-authored-by: Oleksandr Meteiko <[email protected]> Co-authored-by: Mateusz Wisniewski <[email protected]> Co-authored-by: Benjamin Lindner <[email protected]> Co-authored-by: Kacper Małachowski <[email protected]> Co-authored-by: Xin Ruan <[email protected]> Co-authored-by: Tobias Schuhmacher <[email protected]> Co-authored-by: Andreas Thaler <[email protected]> Co-authored-by: Marek Michali <[email protected]> Co-authored-by: Korbinian Stoemmer <[email protected]> Co-authored-by: Piotr Halama <[email protected]> Co-authored-by: Marcin Szwed <[email protected]>
dekiel · Jan 12, 2024 · 9be28ee · 9be28ee
1 parent 06cdd53
commit 9be28ee
Show file tree

Hide file tree

Showing 5 changed files with 49 additions and 21 deletions.
diff --git a/...cluster/resources/gatekeeper-constraints/workloads/imageBuilderAdoSecretTrustedUsage.yaml b/...cluster/resources/gatekeeper-constraints/workloads/imageBuilderAdoSecretTrustedUsage.yaml
@@ -0,0 +1,20 @@
+# Constraint to allow only image-builder tool trusted usage on tekton cluster run as image-builder service account identity.
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: SecretTrustedUsage
+metadata:
+  name: image-builder-ado
+spec:
+  enforcementAction: deny
+  match:
+    kinds:
+      - apiGroups: [ "" ]
+        kinds: [ "Pod" ]
+  parameters:
+    restrictedSecrets:
+      - image-builder-ado-secret
+    trustedImages:
+      - image: "europe-docker.pkg.dev/kyma-project/prod/image-builder:*"
+        command:
+          - /tools/entrypoint
+        args: [ ]
+        entrypoint_options: '^{.*"args":\["\/image-builder","--name=.+","--config=\/config\/kaniko-build-config\.yaml","--context=.+","--dockerfile=.+","--build-in-ado=true"\],"container_name":"test",.*}$'
diff --git a/prow/cluster/resources/gatekeeper-constraints/workloads/signifySecretTrustedUsage.yaml b/prow/cluster/resources/gatekeeper-constraints/workloads/signifySecretTrustedUsage.yaml
@@ -20,6 +20,12 @@ spec:
           - /tools/entrypoint
         args: []
         entrypoint_options: '^{.*"args":\["\/image-builder","--name=.+","--config=\/config\/kaniko-build-config\.yaml","--context=.+","--dockerfile=.+"\],"container_name":"test",.*}$'
+      # postsubmit prowjob using image-builder image build in CI
+      - image: "europe-docker.pkg.dev/kyma-project/prod/image-builder:*"
+        command:
+          - /tools/entrypoint
+        args: [ ]
+        entrypoint_options: '^{.*"args":\["\/image-builder","--name=.+","--config=\/config\/kaniko-build-config\.yaml","--context=.+","--dockerfile=.+"\],"container_name":"test",.*}$'
       # postsubmit: main-lifecycle-mgr-build
       - image: "eu.gcr.io/sap-kyma-neighbors-dev/image-builder:*"
         command:

diff --git a/prow/jobs/kyma-project/test-infra/buildpack.yaml b/prow/jobs/kyma-project/test-infra/buildpack.yaml
@@ -21,7 +21,7 @@ presubmits: # runs on PRs
         - ^main$
       spec:
         containers:
-          - image: "eu.gcr.io/sap-kyma-neighbors-dev/image-builder:v20230313-8dfce5f0b"
+          - image: "europe-docker.pkg.dev/kyma-project/prod/image-builder:v20231213-b563bbe4"
             securityContext:
               privileged: false
               seccompProfile:
@@ -70,7 +70,7 @@ presubmits: # runs on PRs
         - ^main$
       spec:
         containers:
-          - image: "eu.gcr.io/sap-kyma-neighbors-dev/image-builder:v20230313-8dfce5f0b"
+          - image: "europe-docker.pkg.dev/kyma-project/prod/image-builder:v20231213-b563bbe4"
             securityContext:
               privileged: false
               seccompProfile:
@@ -119,7 +119,7 @@ presubmits: # runs on PRs
         - ^main$
       spec:
         containers:
-          - image: "eu.gcr.io/sap-kyma-neighbors-dev/image-builder:v20230313-8dfce5f0b"
+          - image: "europe-docker.pkg.dev/kyma-project/prod/image-builder:v20231213-b563bbe4"
             securityContext:
               privileged: false
               seccompProfile:
@@ -172,7 +172,7 @@ postsubmits: # runs on main
         - ^main$
       spec:
         containers:
-          - image: "eu.gcr.io/sap-kyma-neighbors-dev/image-builder:v20230313-8dfce5f0b"
+          - image: "europe-docker.pkg.dev/kyma-project/prod/image-builder:v20231213-b563bbe4"
             securityContext:
               privileged: false
               seccompProfile:
@@ -222,7 +222,7 @@ postsubmits: # runs on main
         - ^main$
       spec:
         containers:
-          - image: "eu.gcr.io/sap-kyma-neighbors-dev/image-builder:v20230313-8dfce5f0b"
+          - image: "europe-docker.pkg.dev/kyma-project/prod/image-builder:v20231213-b563bbe4"
             securityContext:
               privileged: false
               seccompProfile:
@@ -272,7 +272,7 @@ postsubmits: # runs on main
         - ^main$
       spec:
         containers:
-          - image: "eu.gcr.io/sap-kyma-neighbors-dev/image-builder:v20230313-8dfce5f0b"
+          - image: "europe-docker.pkg.dev/kyma-project/prod/image-builder:v20231213-b563bbe4"
             securityContext:
               privileged: false
               seccompProfile:

diff --git a/prow/jobs/kyma-project/test-infra/images.yaml b/prow/jobs/kyma-project/test-infra/images.yaml
@@ -15,19 +15,26 @@ presubmits: # runs on PRs
       max_concurrency: 10
       spec:
         containers:
-          - image: "eu.gcr.io/sap-kyma-neighbors-dev/image-builder:v20230313-8dfce5f0b"
+          - image: "europe-docker.pkg.dev/kyma-project/prod/image-builder:v20231213-b563bbe4"
             securityContext:
               privileged: false
               seccompProfile:
                 type: RuntimeDefault
               allowPrivilegeEscalation: false
+            env:
+              - name: "ADO_PAT"
+                valueFrom:
+                  secretKeyRef:
+                    name: "image-builder-ado-token"
+                    key: "token"
             command:
               - "/image-builder"
             args:
               - "--name=image-builder"
               - "--config=/config/kaniko-build-config.yaml"
               - "--context=."
               - "--dockerfile=cmd/image-builder/images/kaniko/Dockerfile"
+              - "--build-in-ado=true"
             resources:
               requests:
                 memory: 500Mi
@@ -36,16 +43,10 @@ presubmits: # runs on PRs
               - name: config
                 mountPath: /config
                 readOnly: true
-              - name: signify-secret
-                mountPath: /secret
-                readOnly: true
         volumes:
           - name: config
             configMap:
               name: kaniko-build-config
-          - name: signify-secret
-            secret:
-              secretName: signify-dev-secret
     - name: pull-main-build-testimages
       decorate: true
       labels:
@@ -98,19 +99,26 @@ postsubmits:
       max_concurrency: 10
       spec:
         containers:
-          - image: "eu.gcr.io/sap-kyma-neighbors-dev/image-builder:v20230313-8dfce5f0b"
+          - image: "europe-docker.pkg.dev/kyma-project/prod/image-builder:v20231213-b563bbe4"
             securityContext:
               privileged: false
               seccompProfile:
                 type: RuntimeDefault
               allowPrivilegeEscalation: false
+            env:
+              - name: "ADO_PAT"
+                valueFrom:
+                  secretKeyRef:
+                    name: "image-builder-ado-token"
+                    key: "token"
             command:
               - "/image-builder"
             args:
               - "--name=image-builder"
               - "--config=/config/kaniko-build-config.yaml"
               - "--context=."
               - "--dockerfile=cmd/image-builder/images/kaniko/Dockerfile"
+              - "--build-in-ado=true"
             resources:
               requests:
                 memory: 500Mi
@@ -119,16 +127,10 @@ postsubmits:
               - name: config
                 mountPath: /config
                 readOnly: true
-              - name: signify-secret
-                mountPath: /secret
-                readOnly: true
         volumes:
           - name: config
             configMap:
               name: kaniko-build-config
-          - name: signify-secret
-            secret:
-              secretName: signify-dev-secret
     - name: post-main-build-testimages
       decorate: true
       labels:

diff --git a/templates/data/test-infra/buildpack-data.yaml b/templates/data/test-infra/buildpack-data.yaml
@@ -11,7 +11,7 @@ templates:
               - "^main$"
             pubsub_project: "sap-kyma-prow"
             pubsub_topic: "prowjobs"
-            image: eu.gcr.io/sap-kyma-neighbors-dev/image-builder:v20230313-8dfce5f0b
+            image: europe-docker.pkg.dev/kyma-project/prod/image-builder:v20231213-b563bbe4
             command: /image-builder
             request_memory: "1.5Gi"
             request_cpu: "1"