Skip to content

Commit b3ac165

Browse files
minmzzhangminmzzhang
authored
feat: support protected repositories with Tekton Chains provenance (#136)
* feat: support protected repositories with Tekton Chains provenance Add support for cloning source code from protected (private) Git repositories in the Tekton supply-chain pipeline. Credentials are stored in Vault and delivered to the pipeline via an ExternalSecret that generates .git-credentials and .gitconfig files for the git-clone task's basic-auth workspace. Supply-chain chart changes: - Add init task (skopeo pre-flight image check, skip rebuild) - Add optional git-auth workspace and Chains provenance results (CHAINS-GIT_URL, CHAINS-GIT_COMMIT, IMAGE_URL, IMAGE_DIGEST) - Add ExternalSecret for git credentials (Opaque with .git-credentials) - Conditionally attach git-credentials secret to pipeline SA - Add skopeo image to tasks.images for the init task - Migrate all Tekton resources from v1beta1 to v1 API Generator and feature fragments: - Add protected-repos feature fragment with git.credentials overrides and qtodo.repository placeholder - Add --git-repo CLI argument to gen-feature-variants.py (required when protected-repos feature is enabled) - Add ignoreDifferences for Tekton Task/Pipeline defaulted fields to the supply-chain feature fragment Default values-hub.yaml: - Extend hub-supply-chain-jwt-secret Vault policy to cover secret/data/hub/supply-chain/* - Add commented-out Tekton ignoreDifferences, git.credentials overrides, and qtodo.repository override Documentation: - Update docs/supply-chain.md with protected repos setup, generator --git-repo usage, and git-auth workspace selection - Update scripts/gen-feature-variants.md with --git-repo examples - Add git-credentials entry to values-secret.yaml.template Signed-off-by: Min Zhang <minzhang@redhat.com> * feat: SSH auth support and review fixes for protected repositories - Support SSH auth for protected repositories - Fix ESO SSH template with index syntax for hyphenated keys - Add Vault NetworkPolicy rules for registry-token-refresher - Update gen-feature-variants with protected-repos feature - Clarify that git credentials use SA injection (no git-auth workspace binding needed) Signed-off-by: Min Zhang <minzhang@redhat.com> * docs: differentiate git-auth workspace binding for HTTPS vs SSH modes HTTPS mode requires explicitly binding the git-auth workspace to the qtodo-git-credentials secret, while SSH mode must leave it unbound due to the git-clone ClusterTask's prepare.sh chmod failing on read-only projected volume symlinks. Signed-off-by: Min Zhang <minzhang@redhat.com> * fix: address PR #136 review feedback from Manuel (mlorenzofr) - Restore PR #139 dedup logic (named list upsert, duplicate override validation) that was inadvertently removed - Use file-based path instead of inline value for HTTPS git credentials and registry token to avoid plaintext password leaks in values-secret - Add | trim to ESO password template for path-sourced credentials - Add ssh-keygen instructions and passwordless key requirement - Fix make load-secrets -> ./pattern.sh make load-secrets - Add explicit SSH URL example to qtodo.repository override comment Signed-off-by: Min Zhang <minzhang@redhat.com> --------- Signed-off-by: Min Zhang <minzhang@redhat.com>
1 parent 89edf48 commit b3ac165

25 files changed

Lines changed: 625 additions & 21 deletions

‎charts/supply-chain/templates/pipeline-qtodo.yaml‎

Lines changed: 53 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
apiVersion: tekton.dev/v1beta1
2+
apiVersion: tekton.dev/v1
33
kind: Pipeline
44
metadata:
55
name: qtodo-supply-chain
@@ -8,12 +8,20 @@ spec:
88
params:
99
- name: git-url
1010
type: string
11-
description: The URL of the public Github qtodo repository
11+
description: The URL of the qtodo repository (public or protected)
1212
default: {{ .Values.qtodo.repository | quote }}
1313
- name: git-revision
1414
type: string
15-
description: The revision of the public Github qtodo repository
15+
description: The revision of the qtodo repository
1616
default: {{ .Values.qtodo.revision }}
17+
- name: rebuild
18+
type: string
19+
description: Force rebuild the image even if it already exists
20+
default: "false"
21+
- name: skip-checks
22+
type: string
23+
description: Skip pre-build checks against existing image
24+
default: "false"
1725
- name: qtodo-build-cmd
1826
type: string
1927
description: The command to build the qtodo artifact
@@ -100,9 +108,44 @@ spec:
100108
workspaces:
101109
- name: qtodo-source
102110
- name: registry-auth-config
111+
- name: git-auth
112+
optional: true
113+
114+
results:
115+
- name: CHAINS-GIT_URL
116+
description: The git URL used for the build (Tekton Chains provenance)
117+
value: $(tasks.qtodo-clone-repository.results.URL)
118+
- name: CHAINS-GIT_COMMIT
119+
description: The git commit SHA used for the build (Tekton Chains provenance)
120+
value: $(tasks.qtodo-clone-repository.results.COMMIT)
121+
- name: IMAGE_URL
122+
description: The image URL built by the pipeline (Tekton Chains provenance)
123+
value: $(tasks.qtodo-build-image.results.IMAGE_URL)
124+
- name: IMAGE_DIGEST
125+
description: The image digest built by the pipeline (Tekton Chains provenance)
126+
value: $(tasks.qtodo-build-image.results.IMAGE_DIGEST)
103127

104128
tasks:
129+
- name: init
130+
taskRef:
131+
name: init
132+
kind: Task
133+
params:
134+
- name: image-url
135+
value: $(params.image-target)
136+
- name: rebuild
137+
value: $(params.rebuild)
138+
- name: skip-checks
139+
value: $(params.skip-checks)
140+
105141
- name: qtodo-clone-repository
142+
runAfter:
143+
- init
144+
when:
145+
- input: $(tasks.init.results.build)
146+
operator: in
147+
values:
148+
- "true"
106149
taskRef:
107150
resolver: cluster
108151
params:
@@ -120,6 +163,13 @@ spec:
120163
workspaces:
121164
- name: output
122165
workspace: qtodo-source
166+
{{- if eq (default "https" .Values.git.credentials.authType) "ssh" }}
167+
- name: ssh-directory
168+
workspace: git-auth
169+
{{- else }}
170+
- name: basic-auth
171+
workspace: git-auth
172+
{{- end }}
123173

124174
- name: qtodo-build-artifact
125175
runAfter:

‎charts/supply-chain/templates/pipelinerun-qtodo.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ spec:
9292
fi
9393
9494
cat <<'MANIFEST' | oc create -f -
95-
apiVersion: tekton.dev/v1beta1
95+
apiVersion: tekton.dev/v1
9696
kind: PipelineRun
9797
metadata:
9898
generateName: qtodo-supply-chain-

‎charts/supply-chain/templates/rbac/pipeline-sa.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,7 @@ metadata:
1010
argocd.argoproj.io/compare-options: IgnoreExtraneous
1111
argocd.argoproj.io/syncOptions: ServerSideApply=true
1212
secrets:
13-
- name: qtodo-registry-auth
13+
- name: qtodo-registry-auth
14+
{{- if .Values.git.credentials.enabled }}
15+
- name: qtodo-git-credentials
16+
{{- end }}

‎charts/supply-chain/templates/rbac/registry-token-refresher.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,9 @@ spec:
7272
spec:
7373
backoffLimit: 3
7474
template:
75+
metadata:
76+
labels:
77+
app.kubernetes.io/name: registry-token-refresher
7578
spec:
7679
serviceAccountName: {{ .Values.pipelineServiceAccount }}
7780
restartPolicy: Never

‎charts/supply-chain/templates/secrets/qtodo-git-credentials.yaml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
{{- if .Values.git.credentials.enabled }}
2+
{{- $authType := .Values.git.credentials.authType | default "https" }}
3+
{{- $host := .Values.git.credentials.host }}
4+
---
5+
apiVersion: "external-secrets.io/v1beta1"
6+
kind: ExternalSecret
7+
metadata:
8+
name: qtodo-git-credentials
9+
namespace: {{ .Release.Namespace | default .Values.global.namespace }}
10+
spec:
11+
refreshInterval: 15s
12+
secretStoreRef:
13+
name: {{ .Values.global.secretStore.name }}
14+
kind: {{ .Values.global.secretStore.kind }}
15+
target:
16+
name: qtodo-git-credentials
17+
template:
18+
{{- if eq $authType "ssh" }}
19+
type: kubernetes.io/ssh-auth
20+
metadata:
21+
annotations:
22+
tekton.dev/git-0: {{ $host | quote }}
23+
data:
24+
ssh-privatekey: {{ printf "{{ index . \"%s\" }}" .Values.git.credentials.sshPrivateKeyKey | quote }}
25+
known_hosts: {{ printf "{{ index . \"%s\" }}" .Values.git.credentials.knownHostsKey | quote }}
26+
data:
27+
- secretKey: {{ .Values.git.credentials.sshPrivateKeyKey }}
28+
remoteRef:
29+
key: {{ .Values.git.credentials.vaultPath }}
30+
property: {{ .Values.git.credentials.sshPrivateKeyKey }}
31+
- secretKey: {{ .Values.git.credentials.knownHostsKey }}
32+
remoteRef:
33+
key: {{ .Values.git.credentials.vaultPath }}
34+
property: {{ .Values.git.credentials.knownHostsKey }}
35+
{{- else }}
36+
{{- $hostBare := $host | trimPrefix "https://" | trimPrefix "http://" }}
37+
{{- $userKey := .Values.git.credentials.usernameKey }}
38+
{{- $passKey := .Values.git.credentials.passwordKey }}
39+
type: Opaque
40+
metadata:
41+
annotations:
42+
tekton.dev/git-0: {{ $host | quote }}
43+
data:
44+
.gitconfig: |
45+
[credential "{{ $host }}"]
46+
helper = store
47+
.git-credentials: {{ printf "https://{{ .%s }}:{{ .%s | trim }}@%s" $userKey $passKey $hostBare | quote }}
48+
data:
49+
- secretKey: {{ $userKey }}
50+
remoteRef:
51+
key: {{ .Values.git.credentials.vaultPath }}
52+
property: {{ $userKey }}
53+
- secretKey: {{ $passKey }}
54+
remoteRef:
55+
key: {{ .Values.git.credentials.vaultPath }}
56+
property: {{ $passKey }}
57+
{{- end }}
58+
{{- end }}

‎charts/supply-chain/templates/tasks/build-artifact.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
apiVersion: tekton.dev/v1beta1
2+
apiVersion: tekton.dev/v1
33
kind: Task
44
metadata:
55
name: qtodo-build-artifact

‎charts/supply-chain/templates/tasks/generate-sbom.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
apiVersion: tekton.dev/v1beta1
2+
apiVersion: tekton.dev/v1
33
kind: Task
44
metadata:
55
name: qtodo-generate-sbom

‎charts/supply-chain/templates/tasks/init.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
apiVersion: tekton.dev/v1
3+
kind: Task
4+
metadata:
5+
labels:
6+
app.kubernetes.io/version: "0.1"
7+
annotations:
8+
tekton.dev/pipelines.minVersion: "0.12.1"
9+
tekton.dev/tags: "supply-chain"
10+
name: init
11+
namespace: {{ .Values.global.namespace }}
12+
spec:
13+
description: >-
14+
Initialize Pipeline Task. Determines whether the image should be built
15+
by checking if the target image already exists in the registry.
16+
Supports rebuild and skip-checks flags.
17+
params:
18+
- name: image-url
19+
description: Image URL for build by PipelineRun
20+
- name: rebuild
21+
description: Rebuild the image even if it exists
22+
default: "false"
23+
- name: skip-checks
24+
description: Skip checks against built image
25+
default: "false"
26+
results:
27+
- name: build
28+
description: Defines if the image in param image-url should be built
29+
steps:
30+
- name: init
31+
image: {{ .Values.tasks.images.skopeo }}
32+
computeResources:
33+
limits:
34+
memory: 256Mi
35+
requests:
36+
memory: 256Mi
37+
cpu: 100m
38+
env:
39+
- name: IMAGE_URL
40+
value: $(params.image-url)
41+
- name: REBUILD
42+
value: $(params.rebuild)
43+
- name: SKIP_CHECKS
44+
value: $(params.skip-checks)
45+
script: |
46+
#!/bin/bash
47+
echo "Build Initialize: $IMAGE_URL"
48+
echo
49+
50+
echo "Determine if Image Already Exists"
51+
if [ "$REBUILD" == "true" ] || [ "$SKIP_CHECKS" == "false" ] || ! skopeo inspect --no-tags --raw "docker://$IMAGE_URL" &>/dev/null; then
52+
echo -n "true" > $(results.build.path)
53+
else
54+
echo -n "false" > $(results.build.path)
55+
fi

‎charts/supply-chain/templates/tasks/restart-qtodo.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
apiVersion: tekton.dev/v1beta1
2+
apiVersion: tekton.dev/v1
33
kind: Task
44
metadata:
55
name: restart-qtodo

‎charts/supply-chain/templates/tasks/sbom-attest.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
apiVersion: tekton.dev/v1beta1
2+
apiVersion: tekton.dev/v1
33
kind: Task
44
metadata:
55
name: qtodo-sbom-attestation

0 commit comments

Comments
 (0)