feat(ISV-7115): add rh-direct-sign-image task #2301
+458
−0
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| # rh-direct-sign-image | ||
|
|
||
| Task to create internalrequests to directly sign snapshot components | ||
|
|
||
| ## Parameters | ||
|
|
||
| | Name | Description | Optional | Default value | | ||
| |----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------|---------------------------------------------------| | ||
| | snapshotPath | Path to the JSON string of the mapped Snapshot spec in the data workspace | No | - | | ||
| | dataPath | Path to the JSON string of the merged data to use in the data workspace | No | - | | ||
| | requester | Name of the user that requested the signing, for auditing purposes | No | - | | ||
| | requestTimeout | InternalRequest timeout | Yes | 1800 | | ||
| | concurrentLimit | The maximum number of signing requests to run in parallel | Yes | 8 | | ||
| | pipelineRunUid | The uid of the current pipelineRun. Used as a label value when creating internal requests | No | - | | ||
| | pyxisServer | The server type to use. Options are 'production','production-internal','stage-internal' and 'stage' | Yes | production | | ||
| | pyxisSecret | The kubernetes secret to use to authenticate to Pyxis. It needs to contain two keys: key and cert | No | - | | ||
| | batchLimit | size of batch attributes to send to internal-request. As internal request arguments are need to be strings, size here represent maximal string length of `references` and `manifest_digests` sent to internal request | Yes | 15000 | | ||
| | signRegistryAccessPath | The relative path in the workspace to a text file that contains a list of repositories that needs registry.access.redhat.com image references to be signed (i.e. requires_terms=true), one repository string per line, e.g. "rhtas/cosign-rhel9" | No | - | | ||
| | ociStorage | The OCI repository where the Trusted Artifacts are stored | Yes | empty | | ||
| | ociArtifactExpiresAfter | Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire | Yes | 1d | | ||
| | trustedArtifactsDebug | Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable | Yes | "" | | ||
| | orasOptions | oras options to pass to Trusted Artifacts calls | Yes | "" | | ||
| | sourceDataArtifact | Location of trusted artifacts to be used to populate data directory | Yes | "" | | ||
| | dataDir | The location where data will be stored | Yes | /var/workdir/release | | ||
| | taskGitUrl | The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored | No | - | | ||
| | taskGitRevision | The revision in the taskGitUrl repo to be used | No | - | | ||
| | signingRepo | Git repository URL containing the signing tasks | Yes | https://gitlab.cee.redhat.com/signing/signing.git | | ||
| | signingRevision | Git revision (branch, tag, or commit) in the signing repository | Yes | main | | ||
| | signPipeline | Name of the internal pipeline to use for container signing | Yes | container-signing | | ||
| | signPipelineServiceAccount | Service account to use for the signing pipeline | Yes | signing-pipeline-sa | | ||
| | pipelineImage | The image to use for the signing pipeline | Yes | quay.io/konflux-ci/signing:latest | | ||
| | caTrustConfigMapName | The name of the ConfigMap to read CA bundle data from | Yes | trusted-ca | | ||
| | caTrustConfigMapKey | The name of the key in the ConfigMap that contains the CA bundle data | Yes | ca-bundle.crt | | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,251 @@ | ||
| --- | ||
| apiVersion: tekton.dev/v1 | ||
| kind: Task | ||
| metadata: | ||
| name: rh-direct-sign-image | ||
| annotations: | ||
| tekton.dev/pipelines.minVersion: "0.12.1" | ||
| tekton.dev/tags: release | ||
| spec: | ||
| description: |- | ||
| Task to create internalrequests to directly sign snapshot components | ||
| params: | ||
| - name: snapshotPath | ||
| description: Path to the JSON string of the mapped Snapshot spec in the data workspace | ||
| type: string | ||
| - name: dataPath | ||
| description: Path to the JSON string of the merged data to use in the data workspace | ||
| type: string | ||
| - name: requester | ||
| type: string | ||
| description: Name of the user that requested the signing, for auditing purposes | ||
| - name: requestTimeout | ||
| type: string | ||
| default: "1800" | ||
| description: InternalRequest timeout | ||
| - name: concurrentLimit | ||
| type: string | ||
| description: The maximum number of signing requests to run in parallel | ||
| default: 8 | ||
| - name: pipelineRunUid | ||
| type: string | ||
| description: >- | ||
| The uid of the current pipelineRun. Used as a label value when creating internal requests | ||
| - name: pyxisServer | ||
| type: string | ||
| description: >- | ||
| The server type to use. Options are 'production','production-internal','stage-internal' and 'stage' | ||
| default: production | ||
| - name: pyxisSecret | ||
| type: string | ||
| description: | | ||
| The kubernetes secret to use to authenticate to Pyxis. It needs to contain two keys: key and cert | ||
| - name: batchLimit | ||
| type: string | ||
| description: | | ||
| size of batch attributes to send to internal-request. As internal request arguments are need to be | ||
| strings, size here represent maximal string length of `references` and `manifest_digests` sent to | ||
| internal request | ||
| default: 15000 | ||
| - name: signRegistryAccessPath | ||
| type: string | ||
| description: | | ||
| The relative path in the workspace to a text file that contains a list of repositories | ||
| that needs registry.access.redhat.com image references to be signed (i.e. | ||
| requires_terms=true), one repository string per line, e.g. "rhtas/cosign-rhel9" | ||
| - name: ociStorage | ||
| description: The OCI repository where the Trusted Artifacts are stored | ||
| type: string | ||
| default: "empty" | ||
| - name: ociArtifactExpiresAfter | ||
| description: Expiration date for the trusted artifacts created in the | ||
| OCI repository. An empty string means the artifacts do not expire | ||
| type: string | ||
| default: "1d" | ||
| - name: trustedArtifactsDebug | ||
| description: >- | ||
| Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable | ||
| type: string | ||
| default: "" | ||
| - name: orasOptions | ||
| description: oras options to pass to Trusted Artifacts calls | ||
| type: string | ||
| default: "" | ||
| - name: sourceDataArtifact | ||
| type: string | ||
| description: Location of trusted artifacts to be used to populate data directory | ||
| default: "" | ||
| - name: dataDir | ||
| description: The location where data will be stored | ||
| type: string | ||
| default: /var/workdir/release | ||
| - name: taskGitUrl | ||
| type: string | ||
| description: >- | ||
| The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored | ||
| - name: taskGitRevision | ||
| type: string | ||
| description: The revision in the taskGitUrl repo to be used | ||
| - name: signingRepo | ||
| type: string | ||
| description: Git repository URL containing the signing tasks | ||
| default: "https://gitlab.cee.redhat.com/signing/signing.git" | ||
| - name: signingRevision | ||
| type: string | ||
| description: Git revision (branch, tag, or commit) in the signing repository | ||
| default: "main" | ||
| - name: signPipeline | ||
| type: string | ||
| description: Name of the internal pipeline to use for container signing | ||
| default: "container-signing" | ||
| - name: signPipelineServiceAccount | ||
| type: string | ||
| description: Service account to use for the signing pipeline | ||
| default: "signing-pipeline-sa" | ||
| - name: pipelineImage | ||
| type: string | ||
| description: The image to use for the signing pipeline | ||
| default: quay.io/konflux-ci/signing:latest | ||
| - name: caTrustConfigMapName | ||
| type: string | ||
| description: The name of the ConfigMap to read CA bundle data from | ||
| default: trusted-ca | ||
| - name: caTrustConfigMapKey | ||
| type: string | ||
| description: The name of the key in the ConfigMap that contains the CA bundle data | ||
| default: ca-bundle.crt | ||
| results: | ||
| - description: Produced trusted data artifact | ||
| name: sourceDataArtifact | ||
| type: string | ||
| volumes: | ||
| - name: workdir | ||
| emptyDir: {} | ||
| - name: pyxis-secret-vol | ||
| secret: | ||
| secretName: $(params.pyxisSecret) | ||
| defaultMode: 0444 | ||
| - name: trusted-ca | ||
| configMap: | ||
| name: $(params.caTrustConfigMapName) | ||
| items: | ||
| - key: $(params.caTrustConfigMapKey) | ||
| path: ca-bundle.crt | ||
| optional: true | ||
|
|
||
| stepTemplate: | ||
| volumeMounts: | ||
| - mountPath: /var/workdir | ||
| name: workdir | ||
| - name: trusted-ca | ||
| mountPath: /mnt/trusted-ca | ||
| readOnly: true | ||
| securityContext: | ||
| runAsUser: 1001 | ||
| env: | ||
| - name: IMAGE_EXPIRES_AFTER | ||
| value: $(params.ociArtifactExpiresAfter) | ||
| - name: "ORAS_OPTIONS" | ||
| value: "$(params.orasOptions)" | ||
| - name: "DEBUG" | ||
| value: "$(params.trustedArtifactsDebug)" | ||
| steps: | ||
| - name: use-trusted-artifact | ||
| computeResources: | ||
| limits: | ||
| memory: 64Mi | ||
| cpu: 100m | ||
| requests: | ||
| memory: 64Mi | ||
| cpu: 30m | ||
| ref: | ||
| resolver: "git" | ||
| params: | ||
| - name: url | ||
| value: $(params.taskGitUrl) | ||
| - name: revision | ||
| value: $(params.taskGitRevision) | ||
| - name: pathInRepo | ||
| value: stepactions/use-trusted-artifact/use-trusted-artifact.yaml | ||
| params: | ||
| - name: workDir | ||
| value: $(params.dataDir) | ||
| - name: sourceDataArtifact | ||
| value: $(params.sourceDataArtifact) | ||
|
|
||
| - name: sign-image | ||
| image: quay.io/konflux-ci/release-service-utils@sha256:a2c2fbf89bced4c0421f6a2237f467a94fa38c0b722e4c32368c4d291dbc7323 | ||
| computeResources: | ||
| limits: | ||
| memory: 4Gi | ||
| cpu: "2" | ||
| requests: | ||
| memory: 4Gi | ||
| cpu: "2" | ||
| volumeMounts: | ||
| - name: pyxis-secret-vol | ||
| mountPath: "/etc/secrets" | ||
| env: | ||
| - name: PYXIS_CERT_PATH | ||
| value: /etc/secrets/cert | ||
| - name: PYXIS_KEY_PATH | ||
| value: /etc/secrets/key | ||
| command: | ||
| - rh_direct_sign_image.py | ||
| args: | ||
| - "--pyxis-server" | ||
| - "$(params.pyxisServer)" | ||
| - "--snapshot" | ||
| - "$(params.dataDir)/$(params.snapshotPath)" | ||
| - "--data-file" | ||
| - "$(params.dataDir)/$(params.dataPath)" | ||
| - "--sign-registry-access-file" | ||
| - "$(params.dataDir)/$(params.signRegistryAccessPath)" | ||
| - "--batch-max-size" | ||
| - "$(params.batchLimit)" | ||
| - "--requester" | ||
| - "$(params.requester)" | ||
| - "--pipeline" | ||
| - "$(params.signPipeline)" | ||
| - "--service-account" | ||
| - "$(params.signPipelineServiceAccount)" | ||
| - "--request-timeout" | ||
| - "$(params.requestTimeout)" | ||
| - "--task-id" | ||
| - "$(context.taskRun.uid)" | ||
| - "--pipelinerun-uid" | ||
| - "$(params.pipelineRunUid)" | ||
| - "--signing-repo" | ||
| - "$(params.signingRepo)" | ||
| - "--signing-revision" | ||
| - "$(params.signingRevision)" | ||
| - "--concurrent-limit" | ||
| - "$(params.concurrentLimit)" | ||
| - "--pipeline-image" | ||
| - "$(params.pipelineImage)" | ||
| - "--submit-requests" | ||
|
|
||
| - name: create-trusted-artifact | ||
| computeResources: | ||
| limits: | ||
| memory: 128Mi | ||
| cpu: 500m | ||
| requests: | ||
| memory: 128Mi | ||
| cpu: 250m | ||
|
Allda marked this conversation as resolved.
|
||
| ref: | ||
| resolver: "git" | ||
| params: | ||
| - name: url | ||
| value: "$(params.taskGitUrl)" | ||
| - name: revision | ||
| value: "$(params.taskGitRevision)" | ||
| - name: pathInRepo | ||
| value: stepactions/create-trusted-artifact/create-trusted-artifact.yaml | ||
| params: | ||
| - name: ociStorage | ||
| value: $(params.ociStorage) | ||
| - name: workDir | ||
| value: $(params.dataDir) | ||
| - name: sourceDataArtifact | ||
| value: $(results.sourceDataArtifact.path) | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| --- | ||
| # Declarative mocks for Tekton tests of this task (Python entrypoint). Rendered | ||
| # by .github/scripts/render_python_task_mocks_from_yaml.py when | ||
| # test_tekton_tasks.sh runs. | ||
| version: 1 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| #!/usr/bin/env bash | ||
|
Contributor
There was a problem hiding this comment. file is |
||
| set -eux | ||
| echo "Mock rh_direct_sign_image.py called with: $*" | ||
| echo "$*" >> "${DATA_DIR}/mock_rh_direct_sign_image.txt" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| #!/usr/bin/env bash | ||
| set -euo pipefail | ||
|
|
||
| # Inject DATA_DIR env var into the sign-image step so the mock binary can use it | ||
| # without relying on Tekton parameter substitution inside the mock script itself | ||
| yq -i '.spec.steps[1].env += [{"name": "DATA_DIR", "value": "$(params.dataDir)"}]' "$1" | ||
|
|
||
| # Create a dummy pyxis secret (and delete it first if it exists) | ||
| kubectl delete secret test-pyxis-image-cert --ignore-not-found | ||
| kubectl create secret generic test-pyxis-image-cert --from-literal=cert=mycert --from-literal=key=mykey |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.