Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(clone-image): make clone image configurable #755

Merged
merged 4 commits into from
Feb 23, 2023

Conversation

wass3r
Copy link
Collaborator

@wass3r wass3r commented Jan 20, 2023

closes go-vela/community#456

adds a VELA_CLONE_IMAGE configuration to the server that allows a Vela administrator to define the default clone image to use for the Vela injected clone step.

@wass3r wass3r requested a review from a team as a code owner January 20, 2023 19:34
@codecov
Copy link

codecov bot commented Jan 20, 2023

Codecov Report

Merging #755 (28f24e2) into main (204a906) will increase coverage by 0.01%.
The diff coverage is 100.00%.

Impacted file tree graph

@@            Coverage Diff             @@
##             main     #755      +/-   ##
==========================================
+ Coverage   54.38%   54.39%   +0.01%     
==========================================
  Files         225      225              
  Lines       16184    16188       +4     
==========================================
+ Hits         8802     8806       +4     
  Misses       6989     6989              
  Partials      393      393              
Impacted Files Coverage Δ
compiler/native/clone.go 100.00% <100.00%> (ø)
compiler/native/native.go 84.44% <100.00%> (+0.72%) ⬆️

@wass3r
Copy link
Collaborator Author

wass3r commented Jan 20, 2023

also readied go-vela/worker#417 to fix broken tests once this is sourced in worker code.

docs PR incoming as well

@wass3r
Copy link
Collaborator Author

wass3r commented Jan 20, 2023

docs draft PR opened

@wass3r wass3r self-assigned this Feb 3, 2023
Copy link
Contributor

@jbrockopp jbrockopp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

NOTE: Thanks for this! Code LGTM so requesting changes for visibility purposes (i.e. Trailer.io)

Do we think we need to "validate" the value provided as the clone image?

I know we already ensure a value is provided which is a good thing 👍

But I'm wondering if we want to "force" people to use target/vela-git?

i.e. if !strings.Contains(c.String("clone-image"), "target/vela-git") { return err }

I'm leaning towards NOT forcing and leaving this PR as-is.

However, I thought it was worth opening the discussion for it.

@wass3r
Copy link
Collaborator Author

wass3r commented Feb 22, 2023

@jbrockopp forgot about the comment on this. i'm also leaning towards not doing that. as suggested, you could trivially bypass by using not-target/vela-git, for example. is the thought to limit usage to some sort of "authentic" clone image? i can see doing something with signed images and checking that potentially, if that's the goal. however, not sure if there's a ton of value in limiting flexibility here.

@jbrockopp
Copy link
Contributor

@wass3r

is the thought to limit usage to some sort of "authentic" clone image?

Yeah, thinking it would be a security enhancement to ensure a "valid" clone image is used.

That being said, I worry it would limit organizations from creating their own customized clone image.

Let's plan to roll forward as is and we can always consider it in the future 👍

Copy link
Contributor

@jbrockopp jbrockopp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

allow setting default clone image
3 participants