ROX-27350: Setup ACS trusted tasks builds and publishing #3

msugakov · 2024-12-11T13:20:56Z

Notes

This change can be reviewed per commits as I broke it down in chunks and put descriptions that seemed meaningful. However, due the large number of commits, it can be quicker to just review the final version.
I know that duplication in determine-image-tag isn't great but it will not be the right time to address that now. Let's leave that for ROX-27384 or, most likely, ROX-26026.
Some tasks in the build pipeline don't feel quite fine, e.g. clair-scan and clamav-scan but they aren't failing the pipeline either, and so I decided to keep them in the hopes that one day they may start working. By keeping the tasks it will hopefully be easier to conform EC when that will be required.

Links

Goes on top of the initial pipelines setup Red Hat Konflux update acs-konflux-tasks #2 (already merged).
Used in
Created these Quay repos:
- quay.io/rhacs-eng/konflux-tasks for tasks themselves.
- quay.io/rhacs-eng/konflux-tasks-trust for EC.

Testing

Tested builds in the consuming repos are fine with the new tasks. See the PRs linked above.
EC status is hard to present due to known issues of EC logs disappearing but I'm confident from earlier testing that all should be good once we update the policy.

msugakov · 2024-12-12T08:08:28Z

/retest acs-konflux-tasks-on-push

for consistent text editing experience in IDEs. Generic contents from https://editorconfig.org/ YAML formatting borrowed from https://github.com/stackrox/stackrox/blob/master/.editorconfig

Used the following commands, no manual changes: ``` $ cdrox $ cp .tekton/*-task.yaml ~/projects/stackrox-konflux-tasks/tasks/ ```

to prevent clashes with collector and scanner copies of it.

in order to differentiate this V4 task from V2 task that'll come from the `scanner` repo.

Used the following commands, no further manual changes ``` $ cdrox scanner $ cp .tekton/*-task.yaml ~/projects/stackrox-konflux-tasks/tasks/ ```

See stackrox/konflux-tasks#3

which come from stackrox/konflux-tasks#3

in order to better differentiate it better from its V4 sibling.

`tkn-bundle-oci-ta` is the one which builds and pushes tasks bundle as OCI artifact. https://github.com/konflux-ci/build-definitions/tree/main/task/tkn-bundle-oci-ta/0.1

because there's no base image anyway and because the task isn't happy due to architecture not being specified on the image. ``` step-check-images WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see sigstore/cosign#2755). Instead, please use SBOM attestations. WARNING: Downloading SBOMs this way does not ensure its authenticity. If you want to ensure a tamper-proof SBOM, download it using 'cosign download attestation <image uri>'. Error: could not parse reference: quay.io/redhat-user-workloads/rh-acs-tenant/acs-konflux-tasks@ main.go:74: error during command execution: could not parse reference: quay.io/redhat-user-workloads/rh-acs-tenant/acs-konflux-tasks@ {"result":"ERROR","timestamp":"2024-12-11T19:23:19+00:00","note":"Unexpected error: Script errored at command: cosign download sbom $arch_imageanddigest > ${SBOM_FILE_PATH}.","namespace":"default","successes":0,"failures":0,"warnings":0} ```

which is not used to work with containers without architecture (and there's no way to force architecture via parameters). From logs: ``` step-check-container time="2024-12-12T08:09:55Z" level=info msg="certification library version" version="1.10.2 <commit: 3a93f15cba1f3a4517c02f10914d6cff5cfa5c60>" Error: cannot process image manifest of different arch without platform override Usage: preflight check container [flags] ... ```

This is paired with stackrox/scanner#1742 The idea is to unify determine-image-tag tasks for scanner and collector after that.

and add notes to later unify with the StackRox one. Scanner can be unified with Collector thanks to stackrox/scanner#1742 It could be that the ultimate unification will come in https://issues.redhat.com/browse/ROX-26026 but I created a new task anyway.

since "." makes Cachi2 not love.

to match SCREAMING_CASE of the other ones. This seems to be our predominant convention.

To make things symmetric with the Scanner V2's task.

The pipeline is quick so these timeouts are quite generous and there's room to make them lower, but let's see how it goes.

so that the repo does not look naked.

for user's convenience.

Task bundles are architecture-neutral containers with data and so `build-image-index` is currently disabled and I'm confident we will not need to enable it in the foreseeable future. If some Tekton task needs to use some native binaries, these are provided through step's `image:` attribute. Therefore `build-image-index` is simply redundant at this point.

stackrox/stackrox#13599 will help to catch any regressions.

msugakov · 2024-12-13T10:55:28Z

/retest

which come from stackrox/konflux-tasks#3

See stackrox/konflux-tasks#3

msugakov force-pushed the misha/ROX-27350-initial-setup branch 2 times, most recently from 18c2c31 to ad9ed75 Compare December 11, 2024 19:21

msugakov force-pushed the misha/ROX-27350-initial-setup branch 6 times, most recently from 7016f0d to 36eac71 Compare December 12, 2024 10:05

msugakov added 6 commits December 12, 2024 11:17

Create basic .editorconfig

b0684e7

for consistent text editing experience in IDEs. Generic contents from https://editorconfig.org/ YAML formatting borrowed from https://github.com/stackrox/stackrox/blob/master/.editorconfig

Add basic .gitignore

ac95cc2

Copy custom tasks from StackRox repo verbatim

6d8ae9f

Used the following commands, no manual changes: ``` $ cdrox $ cp .tekton/*-task.yaml ~/projects/stackrox-konflux-tasks/tasks/ ```

Rename determine-image-tag-task to determine-image-tag-stackrox-task

82f797d

to prevent clashes with collector and scanner copies of it.

Rename fetch-scanner-vuln-mappings to fetch-scanner-v4-vuln-mappings

b9a871a

in order to differentiate this V4 task from V2 task that'll come from the `scanner` repo.

Copy custom tasks from scanner repo verbatim

97315b8

Used the following commands, no further manual changes ``` $ cdrox scanner $ cp .tekton/*-task.yaml ~/projects/stackrox-konflux-tasks/tasks/ ```

msugakov force-pushed the misha/ROX-27350-initial-setup branch 3 times, most recently from a98d0a0 to 4056835 Compare December 12, 2024 10:59

msugakov mentioned this pull request Dec 12, 2024

ROX-27350: Use trusted tasks stackrox/scanner#1742

Draft

msugakov force-pushed the misha/ROX-27350-initial-setup branch 3 times, most recently from b798fe8 to 6921801 Compare December 12, 2024 12:17

msugakov changed the title ~~ROX-27350: WIP~~ ROX-27350: Setup ACS trusted tasks builds and publishing Dec 12, 2024

msugakov added a commit to stackrox/collector that referenced this pull request Dec 12, 2024

Switch determine-image-tag to trusted task

a04bf50

See stackrox/konflux-tasks#3

msugakov mentioned this pull request Dec 12, 2024

ROX-27350: Switch determine-image-tag to trusted task stackrox/collector#1992

Draft

5 tasks

msugakov added a commit to stackrox/stackrox that referenced this pull request Dec 12, 2024

Switch to trusted tasks

c695592

which come from stackrox/konflux-tasks#3

msugakov mentioned this pull request Dec 12, 2024

ROX-27350: Use trusted tasks stackrox/stackrox#13599

Draft

9 tasks

msugakov added a commit to stackrox/stackrox that referenced this pull request Dec 12, 2024

Switch to trusted tasks

ad9d2f8

which come from stackrox/konflux-tasks#3

msugakov force-pushed the misha/ROX-27350-initial-setup branch from 3f000ed to 7d11471 Compare December 12, 2024 19:49

Rename fetch-scanner-data-task to fetch-scanner-v2-data-task

b851afd

in order to better differentiate it better from its V4 sibling.

msugakov added 4 commits December 13, 2024 10:16

Switch build-container to tkn-bundle-oci-ta

1155c08

`tkn-bundle-oci-ta` is the one which builds and pushes tasks bundle as OCI artifact. https://github.com/konflux-ci/build-definitions/tree/main/task/tkn-bundle-oci-ta/0.1

Switch to push to our own tasks repo

3ea3f80

msugakov force-pushed the misha/ROX-27350-initial-setup branch 3 times, most recently from 333d151 to 526fa7d Compare December 13, 2024 10:29

msugakov added 14 commits December 13, 2024 11:34

Apply floating tags on the tasks bundle image

2b6b37e

Add step to make our tasks trusted

d8c2203

Change the location of scanner v2 Konflux scripts

ceda8eb

This is paired with stackrox/scanner#1742 The idea is to unify determine-image-tag tasks for scanner and collector after that.

Pin ubi9 tag for Scanner V2 fetch and switch determine tag to ubi9

7a61085

Remove the default value from the Scanner-v2 task's target-dir

5ea6bbb

since "." makes Cachi2 not love.

Rename V2 fetch task's parameters

ed7c114

to match SCREAMING_CASE of the other ones. This seems to be our predominant convention.

Introduce TARGET_DIR param for fetching tasks of stackrox repo

06ae7c8

To make things symmetric with the Scanner V2's task.

Add pipeline timeouts

951c0d9

The pipeline is quick so these timeouts are quite generous and there's room to make them lower, but let's see how it goes.

Introduce BUNDLE_REF output parameter for convenience

a231be0

Add basic readme

c91e794

so that the repo does not look naked.

Move BUNDLE_REF to an informational task and return bundle contents

987be32

for user's convenience.

Switch StackRox tasks to UBI9 and pin references

dd67459

stackrox/stackrox#13599 will help to catch any regressions.

msugakov force-pushed the misha/ROX-27350-initial-setup branch from 526fa7d to dd67459 Compare December 13, 2024 10:44

Add CODEOWNERS so that we get tagged on all PRs

1c67bf3

msugakov force-pushed the misha/ROX-27350-initial-setup branch from 9a6400e to 1c67bf3 Compare December 13, 2024 10:53

msugakov added a commit to stackrox/stackrox that referenced this pull request Dec 13, 2024

Switch to trusted tasks

e2c1de8

which come from stackrox/konflux-tasks#3

msugakov added a commit to stackrox/collector that referenced this pull request Dec 13, 2024

Switch determine-image-tag to trusted task

3513785

See stackrox/konflux-tasks#3

msugakov requested review from kylape and tommartensen December 13, 2024 11:32

msugakov marked this pull request as ready for review December 13, 2024 11:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ROX-27350: Setup ACS trusted tasks builds and publishing #3

ROX-27350: Setup ACS trusted tasks builds and publishing #3

msugakov commented Dec 11, 2024 •

edited

Loading

msugakov commented Dec 12, 2024

msugakov commented Dec 13, 2024

ROX-27350: Setup ACS trusted tasks builds and publishing #3

Are you sure you want to change the base?

ROX-27350: Setup ACS trusted tasks builds and publishing #3

Conversation

msugakov commented Dec 11, 2024 • edited Loading

Notes

Links

Testing

msugakov commented Dec 12, 2024

msugakov commented Dec 13, 2024

msugakov commented Dec 11, 2024 •

edited

Loading