[TEP-0089] Add CSI volumes to the Pods which provide the SPIRE workload API #6539

jagathprakash · 2023-04-13T21:05:04Z

[TEP-0089] SPIRE for non-falsifiable provenance. Add CSI volumes to the task pods. These volumes provide the SPIRE workload API.

This PR is a part of a larger set of PRs to provide non-falsifiable provenance through SPIRE.
In particular this PR uses the SPIRE infrastructure which has already been merged to sign TaskRunStatus.
It also has support to verify if TaskRunStatus has been modified by another workload between reconciles.

Previously merged PRs are

A tracking bug for this feature is at 6597

Changes

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

Has Docs if any changes are user facing, including updates to minimum requirements e.g. Kubernetes version bumps
Has Tests included if any functionality added or changed
Follows the commit message standard
Meets the Tekton contributor standards (including functionality, content, code)
Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings)
Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

NONE

jagathprakash · 2023-04-13T21:05:16Z

/kind feature

jagathprakash · 2023-04-13T21:06:11Z

/assign @jerop @chuangw6 @bobcatfish

tekton-robot · 2023-04-13T21:09:54Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/pod/pod.go	91.8%	92.4%	0.5

tekton-robot · 2023-04-13T21:11:55Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/pod/pod.go	91.8%	92.4%	0.5

jerop

please update the title to reflect which part of the implementation is done in this PR

pkg/pod/pod.go

tekton-robot · 2023-04-14T19:29:20Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/pod/pod.go	91.8%	92.4%	0.5

tekton-robot · 2023-04-14T19:30:05Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/pod/pod.go	91.8%	92.4%	0.5

pkg/pod/pod_test.go

jerop

@jagathprakash please update the PR title, PR description and commit message to reflect the change in this PR only -- right now it seems to imply that it's signing taskrun status but it's only mounting SPIRE's volumes

jagathprakash · 2023-04-17T16:31:12Z

nd commit message to reflect the change in this PR only -- right now it seems to imply that it's signing taskrun status but it's only mounting SPIRE's volumes

@jagathprakash please update the PR title, PR description and commit message to reflect the change in this PR only -- right now it seems to imply that it's signing taskrun status but it's only mounting SPIRE's volumes

Modified the title and the description, to indicate that this PR only loads the required CSI volumes.

tekton-robot · 2023-04-17T16:43:56Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/pod/pod.go	91.8%	92.4%	0.5

tekton-robot · 2023-04-17T16:44:30Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/pod/pod.go	91.8%	92.4%	0.5

tekton-robot · 2023-04-17T16:46:30Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/pod/pod.go	91.8%	92.4%	0.5

This PR is a part of a larger set of PRs to provide non-falsifiable provenance through SPIRE. In particular this PR makes changes to the pod created to run a taskrun. This pod needs access to SpireApi which is mounted as a CSI volume into the pod. Signed-off-by: jagathprakash <[email protected]>

tekton-robot · 2023-04-17T18:24:59Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/pod/pod.go	91.8%	92.4%	0.5

tekton-robot · 2023-04-17T18:26:32Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/pod/pod.go	91.8%	92.4%	0.5

jagathprakash · 2023-04-18T14:14:58Z

@jagathprakash please update the PR title, PR description and commit message to reflect the change in this PR only -- right now it seems to imply that it's signing taskrun status but it's only mounting SPIRE's volumes

Done.

wlynch

/lgtm

wlynch · 2023-04-28T14:19:22Z

Up to you if you want to tackle this in this PR or another - I don't think we have any docs for this feature yet.

Also is there an issue we're using to track this work? We should link this PR to it if we can.

jagathprakash · 2023-04-28T16:07:00Z

Up to you if you want to tackle this in this PR or another - I don't think we have any docs for this feature yet.
We do have a docs/spire.md. Since this does not add a functionality as such, I will update the doc in the PR which adds the functionality.

Also is there an issue we're using to track this work? We should link this PR to it if we can.
I created one.

chuangw6 · 2023-04-28T20:24:02Z

Can we add #6597 to the PR description and perhaps commit message as well?

Otherwise /lgtm

jagathprakash · 2023-05-01T15:24:53Z

Can we add #6597 to the PR description and perhaps commit message as well?

Otherwise /lgtm

Added this issue to the PR description.

tekton-robot · 2023-05-01T16:22:35Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jerop

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [jerop]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tekton-robot added the release-note-none Denotes a PR that doesnt merit a release note. label Apr 13, 2023

tekton-robot requested review from vdemeester and wlynch April 13, 2023 21:05

tekton-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Apr 13, 2023

tekton-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Apr 13, 2023

tekton-robot assigned bobcatfish, chuangw6 and jerop Apr 13, 2023

jerop reviewed Apr 14, 2023

View reviewed changes

pkg/pod/pod.go Show resolved Hide resolved

pkg/pod/pod.go Outdated Show resolved Hide resolved

wlynch requested changes Apr 14, 2023

View reviewed changes

pkg/pod/pod.go Show resolved Hide resolved

pkg/pod/pod.go Show resolved Hide resolved

jerop reviewed Apr 14, 2023

View reviewed changes

pkg/pod/pod.go Outdated Show resolved Hide resolved

jerop reviewed Apr 14, 2023

View reviewed changes

pkg/pod/pod.go Outdated Show resolved Hide resolved

jagathprakash force-pushed the spire-pod branch from 287fc77 to 102b5bb Compare April 14, 2023 19:23

chuangw6 reviewed Apr 14, 2023

View reviewed changes

pkg/pod/pod_test.go Outdated Show resolved Hide resolved

jerop requested changes Apr 17, 2023

View reviewed changes

jagathprakash changed the title ~~[TEP-0089] SPIRE for non-falsifiable provenance.~~ [TEP-0089] SPIRE for non-falsifiable provenance. Add CSI volumes to the task pods which provide the SPIRE workload api. Apr 17, 2023

jagathprakash force-pushed the spire-pod branch from 102b5bb to 99961c5 Compare April 17, 2023 16:36

jerop changed the title ~~[TEP-0089] SPIRE for non-falsifiable provenance. Add CSI volumes to the task pods which provide the SPIRE workload api.~~ [TEP-0089] Add CSI volumes to the Pods which provide the SPIRE workload API Apr 17, 2023

jagathprakash force-pushed the spire-pod branch from 99961c5 to 161c7df Compare April 17, 2023 16:38

jagathprakash requested review from chuangw6, jerop and wlynch April 17, 2023 16:38

jagathprakash force-pushed the spire-pod branch from 161c7df to ebee09b Compare April 17, 2023 18:19

wlynch reviewed Apr 28, 2023

View reviewed changes

tekton-robot assigned wlynch Apr 28, 2023

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Apr 28, 2023

jagathprakash mentioned this pull request Apr 28, 2023

[TEP-0089] Enforce non-falsifiable provenance using SPIRE #6597

Open

10 tasks

jerop approved these changes May 1, 2023

View reviewed changes

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 1, 2023

tekton-robot merged commit dfa1778 into tektoncd:main May 1, 2023

jagathprakash mentioned this pull request May 2, 2023

[TEP-0089] SPIRE for non-falsifiable provenance. Setup the test environment. #6553

Merged

7 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[TEP-0089] Add CSI volumes to the Pods which provide the SPIRE workload API #6539

[TEP-0089] Add CSI volumes to the Pods which provide the SPIRE workload API #6539

jagathprakash commented Apr 13, 2023 •

edited

Loading

jagathprakash commented Apr 13, 2023

jagathprakash commented Apr 13, 2023

tekton-robot commented Apr 13, 2023

tekton-robot commented Apr 13, 2023

jerop left a comment

tekton-robot commented Apr 14, 2023

tekton-robot commented Apr 14, 2023

jerop left a comment

jagathprakash commented Apr 17, 2023

tekton-robot commented Apr 17, 2023

tekton-robot commented Apr 17, 2023

tekton-robot commented Apr 17, 2023

tekton-robot commented Apr 17, 2023

tekton-robot commented Apr 17, 2023

jagathprakash commented Apr 18, 2023

wlynch left a comment

wlynch commented Apr 28, 2023

jagathprakash commented Apr 28, 2023

chuangw6 commented Apr 28, 2023

jagathprakash commented May 1, 2023

tekton-robot commented May 1, 2023

[TEP-0089] Add CSI volumes to the Pods which provide the SPIRE workload API #6539

[TEP-0089] Add CSI volumes to the Pods which provide the SPIRE workload API #6539

Conversation

jagathprakash commented Apr 13, 2023 • edited Loading

Changes

Submitter Checklist

Release Notes

jagathprakash commented Apr 13, 2023

jagathprakash commented Apr 13, 2023

tekton-robot commented Apr 13, 2023

tekton-robot commented Apr 13, 2023

jerop left a comment

Choose a reason for hiding this comment

tekton-robot commented Apr 14, 2023

tekton-robot commented Apr 14, 2023

jerop left a comment

Choose a reason for hiding this comment

jagathprakash commented Apr 17, 2023

tekton-robot commented Apr 17, 2023

tekton-robot commented Apr 17, 2023

tekton-robot commented Apr 17, 2023

tekton-robot commented Apr 17, 2023

tekton-robot commented Apr 17, 2023

jagathprakash commented Apr 18, 2023

wlynch left a comment

Choose a reason for hiding this comment

wlynch commented Apr 28, 2023

jagathprakash commented Apr 28, 2023

chuangw6 commented Apr 28, 2023

jagathprakash commented May 1, 2023

tekton-robot commented May 1, 2023

jagathprakash commented Apr 13, 2023 •

edited

Loading