[TEP-0029] Isolated steps and sidecar workspaces to beta #6922

afrittoli · 2023-07-12T13:16:24Z

Changes

This feature has been implemented in Tekton Pipelines v0.24.0.

Isolated workspaces give our users an option for improved security, which is why it's important to work towards making it available to our users by default.

No outstanding issue exists for this feature, except for the proposal to promote it to beta.

This feature requires the api-features-flag to be set to beta even when using v1beta1, to avoid running into the issues with
v1/v1beta conversion described in TEP-0138. Since this feature has been in alpha until now, this is not a breaking change, and it's specified in the docs that this feature requires the flag to be set when using v1beta1.

Note that this feature was gated both at validation as well as in the reconciler code, which is not how other API driven features are gated. I removed the reconciler code validation to be consistent with the other features.

Fixes #6109

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

Has Docs if any changes are user facing, including updates to minimum requirements e.g. Kubernetes version bumps
Has Tests included if any functionality added or changed
Follows the commit message standard
Meets the Tekton contributor standards (including functionality, content, code)
Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings). See some examples of good release notes.
Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

The "isolated workspaces" feature allows users to share a workspace with dedicated steps and sidecars, instead of the whole TaskRun. The feature has been promoted to "beta".

/kind feature

tekton-robot · 2023-07-12T13:23:26Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/pipeline/v1beta1/task_validation.go	97.1%	97.1%	-0.0
pkg/reconciler/taskrun/resources/apply.go	99.2%	98.4%	-0.8

tekton-robot · 2023-07-12T13:23:46Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/pipeline/v1beta1/task_validation.go	97.1%	97.1%	-0.0
pkg/reconciler/taskrun/resources/apply.go	99.2%	98.4%	-0.8

JeromeJu · 2023-07-12T14:29:47Z

/assign

tekton-robot · 2023-07-13T11:02:19Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/pipeline/v1beta1/task_validation.go	97.1%	97.1%	-0.0
pkg/reconciler/taskrun/resources/apply.go	99.2%	98.4%	-0.8

tekton-robot · 2023-07-13T11:04:55Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/pipeline/v1beta1/task_validation.go	97.1%	97.1%	-0.0
pkg/reconciler/taskrun/resources/apply.go	99.2%	98.4%	-0.8

tekton-robot · 2023-07-13T11:42:58Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/pipeline/v1beta1/task_validation.go	97.1%	97.1%	-0.0
pkg/reconciler/taskrun/resources/apply.go	99.2%	98.4%	-0.8

tekton-robot · 2023-07-13T11:45:09Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/pipeline/v1beta1/task_validation.go	97.1%	97.1%	-0.0
pkg/reconciler/taskrun/resources/apply.go	99.2%	98.4%	-0.8

afrittoli · 2023-07-19T16:15:28Z

/hold

afrittoli · 2023-07-19T16:18:18Z

Based on the discussions in TEP-0138, I think now that every feature that we move into beta should not be implicitly on for the v1beta1 API. Since users had to set the API flag to alpha to use them, asking them to use at least beta won't be a breaking change, and we'll avoid adding issues to the existing problem with the coupling between feature flags and API versions.

@JeromeJu @lbernick wdyt?

JeromeJu · 2023-07-19T18:32:34Z

Based on the discussions in TEP-0138, I think now that every feature that we move into beta should not be implicitly on for the v1beta1 API
Makes perfect sense to me!

afrittoli · 2023-07-20T10:36:49Z

@JeromeJu @lbernick PR updated

afrittoli · 2023-07-20T10:36:55Z

/hold cancel

tekton-robot · 2023-07-20T10:43:34Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/reconciler/taskrun/resources/apply.go	99.2%	98.4%	-0.8

tekton-robot · 2023-07-20T10:43:43Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/reconciler/taskrun/resources/apply.go	99.2%	98.4%	-0.8

vdemeester

/lgtm

pkg/reconciler/taskrun/resources/apply.go

pkg/apis/pipeline/v1beta1/task_validation_test.go

pkg/apis/pipeline/v1beta1/task_validation.go

This feature has been implemented in Tekton Pipelines v0.24.0. Isolated workspaces gives our user an option for improved security, which is why it's important to work towards making it available to our users by default. No outstanding issue exists for this feature, except for the proposal to promote it to beta. This feature requires the api-features-flag to be set to beta even when using v1beta1, to avoid running into the issues with v1/v1beta conversion described in TEP-0138. Since this feature has been in alpha until now, this is not a breaking changes, and it's specified in the docs that this feature requires the flag to be set when using v1beta1. Note that this feature was gated both at validation as well as in the reconciler code, which is not how other API driven features are gated. I removed the reconciler code validation to be consistent with the other features. Fixes tektoncd#6109 Signed-off-by: Andrea Frittoli <[email protected]>

vdemeester · 2023-07-21T09:53:18Z

/lgtm

tekton-robot · 2023-07-21T09:53:36Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/reconciler/taskrun/resources/apply.go	99.2%	99.2%	-0.0

tekton-robot · 2023-07-21T09:55:35Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/reconciler/taskrun/resources/apply.go	99.2%	99.2%	-0.0

tekton-robot · 2023-07-21T11:36:48Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lbernick

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [lbernick]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tekton-robot added kind/feature Categorizes issue or PR as related to a new feature. release-note Denotes a PR that will be considered when it comes time to generate release notes. labels Jul 12, 2023

tekton-robot requested review from bobcatfish and lbernick July 12, 2023 13:16

tekton-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jul 12, 2023

afrittoli added this to the Pipelines v0.50 (LTS) milestone Jul 12, 2023

tekton-robot assigned JeromeJu Jul 12, 2023

afrittoli force-pushed the issues/6109-isolated-to-beta branch from 2057c67 to 581f32c Compare July 13, 2023 10:56

tekton-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jul 13, 2023

afrittoli force-pushed the issues/6109-isolated-to-beta branch from 581f32c to 11e5a7e Compare July 13, 2023 11:37

tekton-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 19, 2023

afrittoli force-pushed the issues/6109-isolated-to-beta branch from 11e5a7e to 6c0b284 Compare July 20, 2023 10:35

tekton-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 20, 2023

vdemeester reviewed Jul 20, 2023

View reviewed changes

tekton-robot assigned vdemeester Jul 20, 2023

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Jul 20, 2023

lbernick reviewed Jul 20, 2023

View reviewed changes

pkg/reconciler/taskrun/resources/apply.go Outdated Show resolved Hide resolved

pkg/apis/pipeline/v1beta1/task_validation_test.go Outdated Show resolved Hide resolved

pkg/apis/pipeline/v1beta1/task_validation.go Outdated Show resolved Hide resolved

afrittoli force-pushed the issues/6109-isolated-to-beta branch from 6c0b284 to a90d610 Compare July 21, 2023 09:47

tekton-robot removed the lgtm Indicates that a PR is ready to be merged. label Jul 21, 2023

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Jul 21, 2023

lbernick approved these changes Jul 21, 2023

View reviewed changes

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 21, 2023

tekton-robot merged commit 1871c30 into tektoncd:main Jul 21, 2023
2 checks passed

JeromeJu mentioned this pull request Oct 2, 2023

Promoting Matrix to Beta 🎉 🎓 #7164

Merged

7 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[TEP-0029] Isolated steps and sidecar workspaces to beta #6922

[TEP-0029] Isolated steps and sidecar workspaces to beta #6922

afrittoli commented Jul 12, 2023 •

edited

Loading

tekton-robot commented Jul 12, 2023

tekton-robot commented Jul 12, 2023

JeromeJu commented Jul 12, 2023

tekton-robot commented Jul 13, 2023

tekton-robot commented Jul 13, 2023

tekton-robot commented Jul 13, 2023

tekton-robot commented Jul 13, 2023

afrittoli commented Jul 19, 2023

afrittoli commented Jul 19, 2023

JeromeJu commented Jul 19, 2023

afrittoli commented Jul 20, 2023

afrittoli commented Jul 20, 2023

tekton-robot commented Jul 20, 2023

tekton-robot commented Jul 20, 2023

vdemeester left a comment

vdemeester commented Jul 21, 2023

tekton-robot commented Jul 21, 2023

tekton-robot commented Jul 21, 2023

tekton-robot commented Jul 21, 2023

[TEP-0029] Isolated steps and sidecar workspaces to beta #6922

[TEP-0029] Isolated steps and sidecar workspaces to beta #6922

Conversation

afrittoli commented Jul 12, 2023 • edited Loading

Changes

Submitter Checklist

Release Notes

tekton-robot commented Jul 12, 2023

tekton-robot commented Jul 12, 2023

JeromeJu commented Jul 12, 2023

tekton-robot commented Jul 13, 2023

tekton-robot commented Jul 13, 2023

tekton-robot commented Jul 13, 2023

tekton-robot commented Jul 13, 2023

afrittoli commented Jul 19, 2023

afrittoli commented Jul 19, 2023

JeromeJu commented Jul 19, 2023

afrittoli commented Jul 20, 2023

afrittoli commented Jul 20, 2023

tekton-robot commented Jul 20, 2023

tekton-robot commented Jul 20, 2023

vdemeester left a comment

Choose a reason for hiding this comment

vdemeester commented Jul 21, 2023

tekton-robot commented Jul 21, 2023

tekton-robot commented Jul 21, 2023

tekton-robot commented Jul 21, 2023

afrittoli commented Jul 12, 2023 •

edited

Loading