direct-sign-index-image.yaml

---
apiVersion: tekton.dev/v1
kind: Task
metadata:
  name: direct-sign-index-image
  annotations:
    tekton.dev/pipelines.minVersion: "0.12.1"
    tekton.dev/tags: release
spec:
  description: |-
    Creates InternalRequests to sign FBC index images via the container-signing pipeline
  params:
    - name: dataPath
      description: Path to the JSON string of the merged data to use in the data workspace
      type: string
    - name: requester
      type: string
      description: Name of the user that requested the signing, for auditing purposes
    - name: requestTimeout
      type: string
      default: "1800"
      description: InternalRequest timeout
    - name: pipelineRunUid
      type: string
      description: The uid of the current pipelineRun. Used as a label value when creating internal requests
    - name: fbcResultsPath
      type: string
      description: Path to the JSON file in the data workspace containing fbc results
    - name: concurrentLimit
      type: string
      description: The maximum number of concurrent signing requests
      default: 8
    - name: ociStorage
      description: The OCI repository where the Trusted Artifacts are stored
      type: string
      default: "empty"
    - name: ociArtifactExpiresAfter
      description: Expiration date for the trusted artifacts created in the
        OCI repository. An empty string means the artifacts do not expire
      type: string
      default: "1d"
    - name: trustedArtifactsDebug
      description: Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable
      type: string
      default: ""
    - name: orasOptions
      description: oras options to pass to Trusted Artifacts calls
      type: string
      default: ""
    - name: sourceDataArtifact
      type: string
      description: Location of trusted artifacts to be used to populate data directory
      default: ""
    - name: dataDir
      description: The location where data will be stored
      type: string
      default: /var/workdir/release
    - name: taskGitUrl
      type: string
      description: The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored
    - name: taskGitRevision
      type: string
      description: The revision in the taskGitUrl repo to be used
    - name: pyxisServer
      type: string
      description: >-
        The server type to use. Options are 'production','production-internal','stage-internal' and 'stage'
      default: production
    - name: pyxisSecret
      type: string
      description: |
        The kubernetes secret to use to authenticate to Pyxis. It needs to contain two keys: key and cert
    - name: batchLimit
      type: string
      description: |
        Maximum size in bytes of each base64-encoded signing_requests batch sent via InternalRequest
      default: 15000
    - name: caTrustConfigMapName
      type: string
      description: The name of the ConfigMap to read CA bundle data from
      default: trusted-ca
    - name: caTrustConfigMapKey
      type: string
      description: The name of the key in the ConfigMap that contains the CA bundle data
      default: ca-bundle.crt
    - name: failOnSignatureLookupError
      type: string
      default: "true"
      description: |
        Fail the task when any Pyxis find_signatures lookup fails; when set to "false", log a warning
        and submit every planned image row for signing without skipping already-signed references
    - name: signingRepo
      type: string
      description: Git repository URL containing the signing tasks
      default: "https://gitlab.cee.redhat.com/signing/signing.git"
    - name: signingRevision
      type: string
      description: Git revision (branch, tag, or commit) in the signing repository
      default: "main"
    - name: signPipeline
      type: string
      description: Name of the internal pipeline to use for container signing
      default: "container-signing"
    - name: signPipelineServiceAccount
      type: string
      description: Service account to use for the signing pipeline
      default: "signing-pipeline-sa"
    - name: pipelineImage
      type: string
      description: The image to use for the signing pipeline
      default: quay.io/konflux-ci/signing:latest
  results:
    - name: sourceDataArtifact
      type: string
      description: Produced trusted data artifact
  volumes:
    - name: workdir
      emptyDir: {}
    - name: pyxis-secret-vol
      secret:
        secretName: $(params.pyxisSecret)
        defaultMode: 0444
    - name: trusted-ca
      configMap:
        name: $(params.caTrustConfigMapName)
        items:
          - key: $(params.caTrustConfigMapKey)
            path: ca-bundle.crt
        optional: true

  stepTemplate:
    volumeMounts:
      - mountPath: /var/workdir
        name: workdir
      - name: trusted-ca
        mountPath: /mnt/trusted-ca
        readOnly: true
    securityContext:
      runAsUser: 1001
    env:
      - name: IMAGE_EXPIRES_AFTER
        value: $(params.ociArtifactExpiresAfter)
      - name: "ORAS_OPTIONS"
        value: "$(params.orasOptions)"
      - name: "DEBUG"
        value: "$(params.trustedArtifactsDebug)"
  steps:
    - name: use-trusted-artifact
      computeResources:
        limits:
          memory: 64Mi
        requests:
          memory: 64Mi
          cpu: 30m
      ref:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: stepactions/use-trusted-artifact/use-trusted-artifact.yaml
      params:
        - name: workDir
          value: $(params.dataDir)
        - name: sourceDataArtifact
          value: $(params.sourceDataArtifact)
    - name: direct-sign-index-image
      image: quay.io/konflux-ci/release-service-utils@sha256:a2c2fbf89bced4c0421f6a2237f467a94fa38c0b722e4c32368c4d291dbc7323
      computeResources:
        limits:
          memory: 1Gi
        requests:
          memory: 1Gi
          cpu: 250m
      volumeMounts:
        - name: pyxis-secret-vol
          mountPath: "/etc/secrets"
      env:
        - name: PYXIS_CERT_PATH
          value: /etc/secrets/cert
        - name: PYXIS_KEY_PATH
          value: /etc/secrets/key
      command:
        - direct_sign_index_image.py
      args:
        - "--pyxis-server"
        - "$(params.pyxisServer)"
        - "--fbc-results"
        - "$(params.dataDir)/$(params.fbcResultsPath)"
        - "--data-file"
        - "$(params.dataDir)/$(params.dataPath)"
        - "--batch-max-size"
        - "$(params.batchLimit)"
        - "--fail-on-lookup-error"
        - "$(params.failOnSignatureLookupError)"
        - "--requester"
        - "$(params.requester)"
        - "--pipeline"
        - "$(params.signPipeline)"
        - "--pipeline-image"
        - "$(params.pipelineImage)"
        - "--service-account"
        - "$(params.signPipelineServiceAccount)"
        - "--request-timeout"
        - "$(params.requestTimeout)"
        - "--task-id"
        - "$(context.taskRun.uid)"
        - "--pipelinerun-uid"
        - "$(params.pipelineRunUid)"
        - "--signing-repo"
        - "$(params.signingRepo)"
        - "--signing-revision"
        - "$(params.signingRevision)"
        - "--concurrent-limit"
        - "$(params.concurrentLimit)"

    - name: create-trusted-artifact
      computeResources:
        limits:
          memory: 128Mi
        requests:
          memory: 128Mi
          cpu: 250m
      ref:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: stepactions/create-trusted-artifact/create-trusted-artifact.yaml
      params:
        - name: ociStorage
          value: $(params.ociStorage)
        - name: workDir
          value: $(params.dataDir)
        - name: sourceDataArtifact
          value: $(results.sourceDataArtifact.path)