chore(deps): update konflux references release-4.21 - #436
chore(deps): update konflux references release-4.21#436red-hat-konflux[bot] wants to merge 1 commit into
Conversation
red-hat-konflux
Bot
added
approved
|
@red-hat-konflux[bot]: No Jira issue is referenced in the title of this pull request. Retaining the jira/valid-reference label as it was manually added. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
2 similar comments
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
1e65aff to
dfff511
Compare
|
New changes are detected. LGTM label has been removed. |
dfff511 to
48d504a
Compare
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
48d504a to
e53cb1f
Compare
|
@red-hat-konflux[bot]: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
This PR contains the following updates:
6387614→2dae3c4a355355→c2cda690.10.7→0.12.00.10.7→0.12.00.3.2→0.4.10.3.1→0.3.227c9760→b961f8b0.2.5→0.2.6b8465d5→5f687150.6.0→0.10.15393bad→393b4d00.2.1→0.2.261b27e6→c06bee8eba24f5→97231d2eb9d539→6a7fbfa0.2→0.36081c41→6bb2697Release Notes
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-oci-ta)
v0.12.0Changed
CONTEXTUALIZE_SBOMis now set tofalseby default. The SBOMcontextualization received an overhaul, enabling the support for builder
content contextualization in SBOMs. To get involved in UAT, set this value
to
trueand report issuesto Mobster maintainers.
CONTEXTUALIZE_SBOMis set totrue, the built image will containnew labels,
io.buildah.stage.nameandio.buildah.stage.base.v0.11.2Fixed
include the
x86_64RPMs (and no other arches) from the prefetch SBOM,even for images built on other arches.
v0.11.1Version 0.11.1 only has relevant changes for the remote variants of this task.
v0.11.0Changed
a directory instead of scanning the the image as an OCI archive. This improves
the scanning time, disk usage and may improve memory usage. More details in
konflux-build-cli/docs/design/syft-image-scanning.md.
from the build VM instead of rsyncing the image back to the cluster first.
For large images, this significantly reduces the time spent on network transfers.
Removed
sbom-syft-generatestep, SBOM generation now happensin the
buildstep.pushstep, the push now happens in thebuildstep.the pipeline will fail with
invalid StepOverride. See the migration guidance below.Migration guidance
Buildah v0.11.0 comes with a migration script that will attempt to automatically
fix the step overrides in your PipelineRuns. In most cases, no manual action will
be needed. But there are cases that the script cannot handle:
script will never get a chance to run on the PipelineRun.
than the build itself and the remote VMs do not have sufficient resources.
If the migration script doesn't solve the problem, please follow the procedure below.
Manual procedure
If you have
sbom-syft-generateorpushstep overrides in the.spec.taskRunSpecssection in your PipelineRun, please remove them. In most cases, this should be all.
However, if you were previously requesting more resources for SBOM generation
than for the build step itself, there is a chance that the build will fail.
In this case, move the relevant overrides to the build step. The same technically
applies for the push step, but it's highly unlikely that pushing would require
more resources than the build.
For example:
spec: taskRunSpecs: - pipelineTaskName: build-container stepSpecs: - - name: sbom-syft-generate + - name: build computeResources: requests: memory: 16Gi limits: memory: 16GiThis will work for build steps that run in-cluster - single-platform builds
and typically also the amd64 builds in a multi-platform build setup.
For build steps that run on remote VMs, the overrides have no effect. In case
the build fails, please switch to a larger VM flavor (consult the documentation
of your particular Konflux deployment to see what's available).
For example:
spec: params: - name: build-platforms value: - localhost - - linux/arm64 + - linux-mxlarge/arm64konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta)
v0.12.0Changed
CONTEXTUALIZE_SBOMis now set tofalseby default. The SBOMcontextualization received an overhaul, enabling the support for builder
content contextualization in SBOMs. To get involved in UAT, set this value
to
trueand report issuesto Mobster maintainers.
CONTEXTUALIZE_SBOMis set totrue, the built image will containnew labels,
io.buildah.stage.nameandio.buildah.stage.base.v0.11.2Fixed
include the
x86_64RPMs (and no other arches) from the prefetch SBOM,even for images built on other arches.
v0.11.1Changed
The build will fail if the connection goes 5 minutes without transfering
a single byte of data.
Fixed
This directory contains the git repository and prefetched dependencies,
which can be a lot of data. The rsync back was an unfortunate side effect
of how tooling generates the remote-oci-ta task variant from the base task,
and was completely unnecessary.
v0.11.0Changed
a directory instead of scanning the the image as an OCI archive. This improves
the scanning time, disk usage and may improve memory usage. More details in
konflux-build-cli/docs/design/syft-image-scanning.md.
from the build VM instead of rsyncing the image back to the cluster first.
For large images, this significantly reduces the time spent on network transfers.
Removed
sbom-syft-generatestep, SBOM generation now happensin the
buildstep.pushstep, the push now happens in thebuildstep.the pipeline will fail with
invalid StepOverride. See the migration guidance below.Migration guidance
Buildah v0.11.0 comes with a migration script that will attempt to automatically
fix the step overrides in your PipelineRuns. In most cases, no manual action will
be needed. But there are cases that the script cannot handle:
script will never get a chance to run on the PipelineRun.
than the build itself and the remote VMs do not have sufficient resources.
If the migration script doesn't solve the problem, please follow the procedure below.
Manual procedure
If you have
sbom-syft-generateorpushstep overrides in the.spec.taskRunSpecssection in your PipelineRun, please remove them. In most cases, this should be all.
However, if you were previously requesting more resources for SBOM generation
than for the build step itself, there is a chance that the build will fail.
In this case, move the relevant overrides to the build step. The same technically
applies for the push step, but it's highly unlikely that pushing would require
more resources than the build.
For example:
spec: taskRunSpecs: - pipelineTaskName: build-container stepSpecs: - - name: sbom-syft-generate + - name: build computeResources: requests: memory: 16Gi limits: memory: 16GiThis will work for build steps that run in-cluster - single-platform builds
and typically also the amd64 builds in a multi-platform build setup.
For build steps that run on remote VMs, the overrides have no effect. In case
the build fails, please switch to a larger VM flavor (consult the documentation
of your particular Konflux deployment to see what's available).
For example:
spec: params: - name: build-platforms value: - localhost - - linux/arm64 + - linux-mxlarge/arm64konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clair-scan)
v0.4.1Changed
Allign script and task version.
v0.4Changed
Allign script and task version.
konflux-ci/konflux-test-tasks (quay.io/konflux-ci/tekton-catalog/task-clamav-scan)
v0.3.2Added
(
.safetensors,.gguf,.ggml). Other layers are still extracted andscanned. If layer listing fails, the task falls back to extracting the
full image.
konflux-ci/container-build-catalog (quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta)
v0.10.1Changed
inputis empty, only run theskip-tastep and skip other stepsquay.io/konflux-ci/task-runnerfor theskip-tastep instead ofubi-minimalv0.10.0v0.9.0Added
pip-index-urlparameter to passPIP_INDEX_URLto Hermeto for pip dependency prefetch.When set, this URL is used as a fallback package index when
requirements.txtdoes not specify--index-url.To use this parameter, add
pip-index-url(type: string, default:"") to your pipeline paramsand pass it to the prefetch-dependencies task.
v0.8.0v0.7.1v0.7.0.repofile for RPM dependencies is now namedhermeto.repoinstead ofcachi2.repokonflux-ci/build-definitions (quay.io/konflux-ci/tekton-catalog/task-show-sbom)
v0.3Fixed
The migration script wasn't attached to the task bundle.
Configuration
📅 Schedule: (UTC)
* 5-23 * * 6)🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.