push-oot-kmods.yaml

---
apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: push-oot-kmods
  annotations:
    tekton.dev/pipelines.minVersion: "0.12.1"
    tekton.dev/tags: release
spec:
  description: >-
    Tekton pipeline to sign out-of-tree kernel modules
    and upload them to their destination repositories
  params:
    - name: release
      type: string
      description: The namespaced name of the Release custom resource initiating this pipeline execution
    - name: releasePlan
      type: string
      description: The namespaced name (namespace/name) of the releasePlan
    - name: releasePlanAdmission
      type: string
      description: The namespaced name (namespace/name) of the releasePlanAdmission
    - name: releaseServiceConfig
      type: string
      description: The namespaced name (namespace/name) of the releaseServiceConfig
    - name: snapshot
      type: string
      description: The namespaced name (namespace/name) of the snapshot
    - name: enterpriseContractPolicy
      type: string
      description: JSON representation of the EnterpriseContractPolicy
    - name: enterpriseContractExtraRuleData
      type: string
      description: |
        Extra rule data to be merged into the policy specified in params.enterpriseContractPolicy. Use syntax
        "key1=value1,key2=value2..."
      default: "pipeline_intention=release"
    - name: verify_ec_task_git_revision
      type: string
      description: Previously used for the Conforma task git resolver, now deprecated and ignored
      default: ignored
    - name: ociStorage
      type: string
      description: The OCI repository where the Trusted Artifacts are stored
      default: "quay.io/konflux-ci/release-service-trusted-artifacts"
    - name: orasOptions
      description: oras options to pass to Trusted Artifacts calls
      type: string
      default: ""
    - name: trustedArtifactsDebug
      description: Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable
      type: string
      default: ""
    - name: dataDir
      description: The location where data will be stored
      type: string
      default: "/var/workdir/release"
    - name: taskGitRevision
      type: string
      description: The revision in the taskGitUrl repo to be used
      default: main
    - name: taskGitUrl
      type: string
      description: The url to the git repo where the release-service-catalog tasks to be used are stored
      default: https://github.com/konflux-ci/release-service-catalog.git
  tasks:
    - name: verify-access-to-resources
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/verify-access-to-resources/verify-access-to-resources.yaml
      params:
        - name: release
          value: $(params.release)
        - name: releasePlan
          value: $(params.releasePlan)
        - name: releasePlanAdmission
          value: $(params.releasePlanAdmission)
        - name: releaseServiceConfig
          value: $(params.releaseServiceConfig)
        - name: snapshot
          value: $(params.snapshot)
        - name: requireInternalServices
          value: "false"
    - name: collect-data
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/collect-data/collect-data.yaml
      params:
        - name: release
          value: $(params.release)
        - name: releasePlan
          value: $(params.releasePlan)
        - name: releasePlanAdmission
          value: $(params.releasePlanAdmission)
        - name: releaseServiceConfig
          value: $(params.releaseServiceConfig)
        - name: snapshot
          value: $(params.snapshot)
        - name: subdirectory
          value: $(context.pipelineRun.uid)
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
      runAfter:
        - verify-access-to-resources
    - name: collect-task-params
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/collect-task-params/collect-task-params.yaml
      params:
        - name: dataDir
          value: "$(params.dataDir)"
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: keysToExtract
          value: |
            [
              {"resultIndex": 0, "key": ".pushToGit", "default": "false"},
              {"resultIndex": 1, "key": ".pushToS3", "default": "false"},
              {"resultIndex": 2, "key": ".pushToAzure", "default": "false"},
              {"resultIndex": 3, "key": ".git.repoUrl"},
              {"resultIndex": 4, "key": ".git.branch", "default": "main"},
              {"resultIndex": 5, "key": ".git.tokenSecret"},
              {"resultIndex": 6, "key": ".s3.endpoint"},
              {"resultIndex": 7, "key": ".s3.bucket"},
              {"resultIndex": 8, "key": ".s3.credentialsSecret"},
              {"resultIndex": 9, "key": ".azure.storageAccount"},
              {"resultIndex": 10, "key": ".azure.container"},
              {"resultIndex": 11, "key": ".azure.spSecret"},
              {"resultIndex": 12, "key": ".ootsign.signing-secret"},
              {"resultIndex": 13, "key": ".ootsign.signingAuthor"},
              {"resultIndex": 14, "key": ".ootsign.checksumFingerprint"},
              {"resultIndex": 15, "key": ".ootsign.checksumKeytab"},
              {"resultIndex": 16, "key": ".ootsign.kmodsPath"},
              {"resultIndex": 17, "key": ".ootsign.signedKmodsPath"},
              {"resultIndex": 18, "key": ".ootsign.vendor"},
              {"resultIndex": 19, "key": ".conforma.workerCount", "default": "4"}
            ]
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.collect-data.results.sourceDataArtifact)"
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
      runAfter:
        - collect-data
    - name: check-data-keys
      taskRef:
        resolver: git
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/check-data-keys/check-data-keys.yaml
      params:
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: systems
          value: |
            [
              {"systemName": "ootsign", "dynamic": false}
            ]
        - name: dataDir
          value: $(params.dataDir)
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.collect-data.results.sourceDataArtifact)"
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - collect-data
    - name: reduce-snapshot
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/reduce-snapshot/reduce-snapshot.yaml
      params:
        - name: SNAPSHOT
          value: $(params.dataDir)/$(tasks.collect-data.results.snapshotSpec)
        - name: SINGLE_COMPONENT
          value: $(tasks.collect-data.results.singleComponentMode)
        - name: SINGLE_COMPONENT_CUSTOM_RESOURCE
          value: snapshot/$(tasks.collect-data.results.snapshotName)
        - name: SINGLE_COMPONENT_CUSTOM_RESOURCE_NS
          value: $(tasks.collect-data.results.snapshotNamespace)
        - name: SNAPSHOT_PATH
          value: $(params.dataDir)/$(tasks.collect-data.results.snapshotSpec)
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.collect-data.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - collect-data
    - name: apply-mapping
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/apply-mapping/apply-mapping.yaml
      params:
        - name: failOnEmptyResult
          value: "true"
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: snapshotPath
          value: "$(tasks.collect-data.results.snapshotSpec)"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.reduce-snapshot.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - reduce-snapshot
    - name: validate-single-component
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/validate-single-component/validate-single-component.yaml
      params:
        - name: snapshotPath
          value: "$(tasks.collect-data.results.snapshotSpec)"
        - name: sourceDataArtifact
          value: "$(tasks.collect-data.results.sourceDataArtifact)"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - collect-data
    - name: verify-conforma
      timeout: "4h00m0s"
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: https://github.com/conforma/tekton-catalog
          - name: revision
            value: "f20c7a8c15a71c9462b11e5a28f8907a29c7075a"
          - name: pathInRepo
            value: "tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml"
      params:
        - name: SNAPSHOT_FILENAME
          value: "$(tasks.collect-data.results.snapshotSpec)"
        - name: SSL_CERT_DIR
          value: /var/run/secrets/kubernetes.io/serviceaccount
        - name: POLICY_CONFIGURATION
          value: $(params.enterpriseContractPolicy)
        - name: STRICT
          value: "true"
        - name: IGNORE_REKOR
          value: "true"
        - name: EXTRA_RULE_DATA
          value: $(params.enterpriseContractExtraRuleData)
        - name: WORKERS
          value: "$(tasks.collect-task-params.results.extractedValues[19])"
        - name: SOURCE_DATA_ARTIFACT
          value: "$(tasks.apply-mapping.results.sourceDataArtifact)"
        - name: TRUSTED_ARTIFACTS_DEBUG
          value: "$(params.trustedArtifactsDebug)"
      runAfter:
        - validate-single-component
        - collect-task-params
    - name: extract-oot-kmods
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/extract-oot-kmods/extract-oot-kmods.yaml
      params:
        - name: snapshotPath
          value: "$(tasks.collect-data.results.snapshotSpec)"
        - name: kmodsPath
          value: $(tasks.collect-task-params.results.extractedValues[16])
        - name: signedKmodsPath
          value: $(tasks.collect-task-params.results.extractedValues[17])
        - name: snapshot
          value: $(params.snapshot)
        - name: sourceDataArtifact
          value: "$(tasks.collect-data.results.sourceDataArtifact)"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - verify-access-to-resources
        - collect-task-params
    - name: sign-oot-kmods
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/sign-oot-kmods/sign-oot-kmods.yaml
      params:
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: signedKmodsPath
          value: $(tasks.collect-task-params.results.extractedValues[17])
        - name: kerberosRealm
          value: IPA.REDHAT.COM
        - name: signingAuthor
          value: $(tasks.collect-task-params.results.extractedValues[13])
        - name: checksumFingerprint
          value: $(tasks.collect-task-params.results.extractedValues[14])
        - name: checksumKeytab
          value: $(tasks.collect-task-params.results.extractedValues[15])
        - name: signing-secret
          value: $(tasks.collect-task-params.results.extractedValues[12])
        - name: sourceDataArtifact
          value: "$(tasks.extract-oot-kmods.results.sourceDataArtifact)"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - extract-oot-kmods
        - collect-task-params
    - name: prepare-and-finalize-artifacts
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/prepare-and-finalize-artifacts/prepare-and-finalize-artifacts.yaml
      params:
        - name: ociStorage
          value: $(params.ociStorage)
        - name: baseDataArtifact
          value: "$(tasks.sign-oot-kmods.results.sourceDataArtifact)"
        - name: rpmDataArtifact
          value: ""
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
        - name: orasOptions
          value: "$(params.orasOptions)"
      runAfter:
        - sign-oot-kmods
    - name: push-to-git
      when:
        - input: "$(tasks.collect-task-params.results.extractedValues[0])"
          operator: in
          values: ["true"]
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/push-oot-kmods-to-git/push-oot-kmods-to-git.yaml
      params:
        - name: sourceDataArtifact
          value: "$(tasks.prepare-and-finalize-artifacts.results.sourceDataArtifact)"
        - name: signedKmodsPath
          value: $(tasks.collect-task-params.results.extractedValues[17])
        - name: dataDir
          value: $(params.dataDir)
        - name: gitRepoUrl
          value: $(tasks.collect-task-params.results.extractedValues[3])
        - name: gitBranch
          value: $(tasks.collect-task-params.results.extractedValues[4])
        - name: gitTokenSecret
          value: $(tasks.collect-task-params.results.extractedValues[5])
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - prepare-and-finalize-artifacts
    - name: push-to-s3
      when:
        - input: "$(tasks.collect-task-params.results.extractedValues[1])"
          operator: in
          values: ["true"]
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/push-oot-kmods-to-s3/push-oot-kmods-to-s3.yaml
      params:
        - name: sourceDataArtifact
          value: "$(tasks.prepare-and-finalize-artifacts.results.sourceDataArtifact)"
        - name: signedKmodsPath
          value: $(tasks.collect-task-params.results.extractedValues[17])
        - name: dataDir
          value: $(params.dataDir)
        - name: s3Endpoint
          value: $(tasks.collect-task-params.results.extractedValues[6])
        - name: s3Bucket
          value: $(tasks.collect-task-params.results.extractedValues[7])
        - name: s3CredentialsSecret
          value: $(tasks.collect-task-params.results.extractedValues[8])
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - prepare-and-finalize-artifacts
    - name: push-to-azure
      when:
        - input: "$(tasks.collect-task-params.results.extractedValues[2])"
          operator: in
          values: ["true"]
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/push-oot-kmods-to-azure/push-oot-kmods-to-azure.yaml
      params:
        - name: sourceDataArtifact
          value: "$(tasks.prepare-and-finalize-artifacts.results.sourceDataArtifact)"
        - name: signedKmodsPath
          value: $(tasks.collect-task-params.results.extractedValues[17])
        - name: dataDir
          value: $(params.dataDir)
        - name: azureStorageAccount
          value: $(tasks.collect-task-params.results.extractedValues[9])
        - name: azureContainer
          value: $(tasks.collect-task-params.results.extractedValues[10])
        - name: azureSpSecret
          value: $(tasks.collect-task-params.results.extractedValues[11])
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - prepare-and-finalize-artifacts