clair_import_pipeline.yaml

---
- name: Get OpenShift CLI image from OpenShift release
  ansible.builtin.command: >
    {{ workingDir }}/bin/oc adm release info --registry-config={{ pullSecretPath }} --image-for cli
    quay.io/openshift-release-dev/ocp-release:{{ mgmt_openshift_version }}-x86_64
  register: r_oc_cli_image
  changed_when: false

- name: Set image facts
  ansible.builtin.set_fact:
    oc_cli_image: "{{ r_oc_cli_image.stdout }}"

- name: Create Clair Import ServiceAccount
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: v1
      kind: ServiceAccount
      metadata:
        name: clair-import
        namespace: openshift-pipelines

- name: Create Clair Import Task
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: tekton.dev/v1
      kind: Task
      metadata:
        name: clair-import
        namespace: openshift-pipelines
      spec:
        results:
          - name: exit-code
            description: "Success of clair import (exit code)"
          - name: status-report
            description: "Report of clair import"
        steps:
          - name: clair-import
            image: "{{ oc_cli_image }}"
            script: |
                #!/bin/bash
                set -uo pipefail

                clair_pod_name=$(oc get pods -n quay-enterprise -l quay-component=clair-app -o name | cut -d/ -f2)
                if oc exec -n quay-enterprise "$clair_pod_name" -- \
                /bin/sh -c "
                  curl -L -o /tmp/updates.json.gz http://{{ quayHostname }}/clair/updates.json.gz
                  /usr/bin/clairctl --config /clair/config.yaml import-updaters /tmp/updates.json.gz
                " > "$(results.status-report.path)" 2>&1; then
                  rc=0
                else
                  rc=$?
                fi
                echo "$rc" > "$(results.exit-code.path)"
                exit "$rc"

- name: Create Clair Import Pipeline
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: tekton.dev/v1
      kind: Pipeline
      metadata:
        name: clair-import
        namespace: openshift-pipelines
      spec:
        tasks:
          - name: clair-import
            taskRef:
              name: clair-import
        results:
          - name: exit-code
            value: $(tasks.clair-import.results.exit-code)
          - name: status-report
            value: $(tasks.clair-import.results.status-report)
        timeout: "1h"