Login to docker to run docker images - #7464

Preload Images still pulls consul, memcached, redis and postgres from
Docker Hub. #7464 removed the Install Docker Client step from this job,
and that script is where 'docker login' runs, so those pulls have been
anonymous since and are subject to the anonymous rate limit.

Log in explicitly, matching what the build job does. Pull requests from
forks have no secrets, so skip the login there and leave those pulls
anonymous instead of failing the step.

This is hardening, not the fix for the current breakage: minio failed
even when authenticated.

Signed-off-by: Charlie Le <charlie_le@apple.com>

* Pull minio from quay.io instead of Docker Hub

Every integration leg is failing at Preload Images:

  Error response from daemon: pull access denied for minio/minio,
  repository does not exist or may require 'docker login':
  denied: requested access to the resource is denied

minio/minio is the first Docker Hub pull in the step, so no leg gets past
it and all 24 fail in about 30 seconds. A CHANGELOG-only pull request
reproduces it, so this is not specific to any change under test. master
was last green at 4061a3d.

This is not a rate limit: the same pull fails right after a successful
'docker login' with the repository credentials. The docker.io/minio/minio
repository is simply no longer accessible.

MinIO still publishes the identical image to quay.io. quay.io/minio/minio
:RELEASE.2024-05-28T17-19-04Z is public and is a manifest list with 8
children, so it covers both the amd64 and arm64 runners.

Point the integration tests, the CI preload list, and the three
development docker-compose stacks at quay.io. The tag is unchanged, so no
behaviour changes.

Signed-off-by: Charlie Le <charlie_le@apple.com>

* Authenticate the integration job's remaining Docker Hub pulls

Preload Images still pulls consul, memcached, redis and postgres from
Docker Hub. #7464 removed the Install Docker Client step from this job,
and that script is where 'docker login' runs, so those pulls have been
anonymous since and are subject to the anonymous rate limit.

Log in explicitly, matching what the build job does. Pull requests from
forks have no secrets, so skip the login there and leave those pulls
anonymous instead of failing the step.

This is hardening, not the fix for the current breakage: minio failed
even when authenticated.

Signed-off-by: Charlie Le <charlie_le@apple.com>

* Resolve the latest release image to a published version

Backport of #7786 onto release-1.22.

integration/util.go derived the query fuzz comparison image straight from
VERSION. The moment VERSION becomes 1.22.0-rc.0 on this branch,
integration_query_fuzz tries to pull
quay.io/cortexproject/cortex:v1.22.0-rc.0, which does not exist: that
image is pushed by the tag build's deploy job, and deploy is gated on
integration passing first.

Ask quay.io which GA tags are actually published instead, and take the
highest one at or below VERSION. The CI step mirrors the same resolution
and exports CORTEX_LATEST_RELEASE_IMAGE for the preload step.

Set the CORTEX_LATEST_RELEASE_IMAGE repository variable to bypass the
lookup.

Signed-off-by: Charlie Le <charlie_le@apple.com>

* Mark release 1.22.0 in progress

Add a '## 1.22.0 in progress' section below an empty
'## master / unreleased', move the existing unreleased entries into it,
and order them [CHANGE] -> [FEATURE] -> [ENHANCEMENT] -> [BUGFIX] per
RELEASE.md.

Also fill the gaps reported by
./tools/release/check-changelog.sh v1.21.1...master:

- new entries for #7513, #7514 and #7559
- fold #7323, #7434, #7458, #7463, #7487, #7505, #7687, #7691, #7716,
  #7726, #7775 and #7807 into the entries they belong to

Signed-off-by: Charlie Le <charlie_le@apple.com>

* Update version to 1.22.0-rc.0

Signed-off-by: Charlie Le <charlie_le@apple.com>

---------

Signed-off-by: Charlie Le <charlie_le@apple.com>

* Pull minio from quay.io instead of Docker Hub

Every integration leg is failing at Preload Images:

  Error response from daemon: pull access denied for minio/minio,
  repository does not exist or may require 'docker login':
  denied: requested access to the resource is denied

minio/minio is the first Docker Hub pull in the step, so no leg gets past
it and all 24 fail in about 30 seconds. A CHANGELOG-only pull request
reproduces it, so this is not specific to any change under test. master
was last green at 4061a3d.

This is not a rate limit: the same pull fails right after a successful
'docker login' with the repository credentials. The docker.io/minio/minio
repository is simply no longer accessible.

MinIO still publishes the identical image to quay.io. quay.io/minio/minio
:RELEASE.2024-05-28T17-19-04Z is public and is a manifest list with 8
children, so it covers both the amd64 and arm64 runners.

Point the integration tests, the CI preload list, and the three
development docker-compose stacks at quay.io. The tag is unchanged, so no
behaviour changes.

Signed-off-by: Charlie Le <charlie_le@apple.com>

* Authenticate the integration job's remaining Docker Hub pulls

Preload Images still pulls consul, memcached, redis and postgres from
Docker Hub. #7464 removed the Install Docker Client step from this job,
and that script is where 'docker login' runs, so those pulls have been
anonymous since and are subject to the anonymous rate limit.

Log in explicitly, matching what the build job does. Pull requests from
forks have no secrets, so skip the login there and leave those pulls
anonymous instead of failing the step.

This is hardening, not the fix for the current breakage: minio failed
even when authenticated.

Signed-off-by: Charlie Le <charlie_le@apple.com>

---------

Signed-off-by: Charlie Le <charlie_le@apple.com>