Add support for Grafeas storage backend by chuangw6 · Pull Request #389 · tektoncd/chains

chuangw6 · 2022-03-03T00:20:26Z

Changes

This PR implements the support for Grafeas storage backend (i.e. Google Container Analysis) via Grafeas open source API.

If Google Container Analysis server is chosen, this new feature will enable Tekton Chains to write provenance to Container Analysis that then can be consumed by GCP services such as Binary Authorization.

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

Docs included if any changes are user facing
Tests included if any functionality added or changed
Follows the commit message standard
Meets the Tekton contributor standards (including
functionality, content, code)
Release notes block below has been filled in or deleted (only if no user facing changes)

Release Notes

action required

1. configure container analysis as storage backend for taskrun and/or oci artifacts.

kubectl patch configmap chains-config -n tekton-chains -p='{"data":{"artifacts.taskrun.storage": "grafeas"}}'
kubectl patch configmap chains-config -n tekton-chains -p='{"data":{"artifacts.oci.storage": "grafeas"}}'

2. inform tekton chains project ID and note name that will be used to create occurrences.

kubectl patch configmap chains-config -n tekton-chains -p='{"data":{"storage.grafeas.projectid": "<GCP_PROJECT_ID>"}}'
kubectl patch configmap chains-config -n tekton-chains -p='{"data":{"storage.grafeas.noteid": "<NOTE_NAME>"}}' (optional, if noteid is not configured, we will generate a name in the format of tekton-<namespace>)

3. Authenticate to GCP (if Container Analysis is chosen for the storage backend)

Use Workload Identity
Enable WI for the KSA tekton-chains-controller under tekton-chains namespace

chuangw6 · 2022-03-03T00:22:43Z

/assign @wlynch

tekton-robot · 2022-03-03T00:22:44Z

@chuangw6: GitHub didn't allow me to assign the following users: wlynch.

Note that only tektoncd members, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

Details

In response to this:

/assign @wlynch

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tekton-robot · 2022-03-03T00:40:39Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/storage.go	45.5%	38.5%	-7.0

tekton-robot · 2022-03-07T01:23:36Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/storage.go	45.5%	38.5%	-7.0

tekton-robot · 2022-03-07T07:34:06Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/grafeas/grafeas.go	Do not exist	73.1%
pkg/chains/storage/storage.go	45.5%	38.5%	-7.0

tekton-robot · 2022-03-07T07:46:04Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/grafeas/grafeas.go	Do not exist	73.1%
pkg/chains/storage/storage.go	45.5%	38.5%	-7.0

tekton-robot · 2022-03-09T19:53:31Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/grafeas/grafeas.go	Do not exist	73.1%

chuangw6 · 2022-03-09T19:55:31Z

/retest

tekton-robot · 2022-03-09T21:08:04Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/grafeas/grafeas.go	Do not exist	73.1%

tekton-robot · 2022-03-09T21:24:08Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/grafeas/grafeas.go	Do not exist	73.6%
pkg/chains/storage/storage.go	45.5%	38.5%	-7.0

tekton-robot · 2022-03-09T22:02:07Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/grafeas/grafeas.go	Do not exist	73.6%
pkg/chains/storage/storage.go	45.5%	38.5%	-7.0

tekton-robot · 2022-03-19T05:36:05Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/grafeas/grafeas.go	Do not exist	78.1%
pkg/chains/storage/storage.go	45.5%	38.5%	-7.0

tekton-robot · 2022-03-19T05:54:04Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/grafeas/grafeas.go	Do not exist	78.1%
pkg/chains/storage/storage.go	45.5%	38.5%	-7.0

tekton-robot · 2022-03-19T06:23:06Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/grafeas/grafeas.go	Do not exist	78.1%
pkg/chains/storage/storage.go	45.5%	38.5%	-7.0

tekton-robot · 2022-03-23T23:19:37Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/grafeas/grafeas.go	Do not exist	78.0%
pkg/chains/storage/storage.go	45.5%	38.5%	-7.0

chuangw6 · 2022-03-24T03:19:08Z

/test pull-tekton-chains-unit-tests

tekton-robot · 2022-03-25T20:34:08Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/storage.go	45.5%	38.5%	-7.0

tekton-robot · 2022-03-25T20:38:08Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/grafeas/grafeas.go	Do not exist	78.6%
pkg/chains/storage/storage.go	45.5%	38.5%	-7.0

chuangw6 · 2022-03-25T22:45:26Z

hi @wlynch ,
Can you please review again if you get a chance? I'll try to see how to solve the issue of the re-request review button. 😅
Thanks a lot!

wlynch

Looking good! Few more changes, mostly structural / documentation though!

tekton-robot · 2022-03-28T21:37:05Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/grafeas/grafeas.go	Do not exist	78.6%
pkg/chains/storage/storage.go	45.5%	38.5%	-7.0

wlynch

/lgtm

tekton-robot · 2022-03-29T14:51:34Z

@wlynch: changing LGTM is restricted to collaborators

Details

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

wlynch · 2022-03-29T14:54:55Z

/assign @priyawadhwa

Yongxuanzhang · 2022-03-29T15:00:05Z

maybe squash the commits before merged?

wlynch · 2022-03-29T15:04:00Z

maybe squash the commits before merged?

Good call! I always miss this 😅

tekton-robot · 2022-03-29T16:51:59Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/grafeas/grafeas.go	Do not exist	78.6%
pkg/chains/storage/storage.go	45.5%	38.5%	-7.0

priyawadhwa

Nice! I'm not super familiar with grafeas, but would it be possible to write an integration test for it?

I'm wondering if we could deploy an instance of grafeas to the integration test cluster & test against that?

priyawadhwa · 2022-03-29T17:21:02Z

maybe squash the commits before merged?

yah i think that's required!

tekton-robot · 2022-03-29T17:46:21Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/grafeas/grafeas.go	Do not exist	78.6%
pkg/chains/storage/storage.go	45.5%	38.5%	-7.0

chuangw6 · 2022-03-29T20:27:06Z

maybe squash the commits before merged?

yah i think that's required!

Done! Thanks for the heads up!

tekton-robot · 2022-03-29T20:27:07Z

The following is the coverage report on the affected files.
Say /test pull-tekton-chains-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/chains/storage/grafeas/grafeas.go	Do not exist	78.6%
pkg/chains/storage/storage.go	45.5%	38.5%	-7.0

priyawadhwa · 2022-03-29T22:32:11Z

/lgtm

tekton-robot · 2022-03-29T22:32:13Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: priyawadhwa, wlynch

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [priyawadhwa]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tekton-robot requested review from font and loosebazooka March 3, 2022 00:20

tekton-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Mar 3, 2022

Yongxuanzhang reviewed Mar 3, 2022

View reviewed changes

Comment thread pkg/chains/storage/ca/ca.go Outdated

Comment thread pkg/chains/storage/ca/ca.go Outdated

Comment thread pkg/chains/storage/ca/ca.go Outdated

wlynch requested changes Mar 3, 2022

View reviewed changes

tekton-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Mar 7, 2022

chuangw6 changed the title ~~Add support for Google Container Analysis storage backend~~ Add support for Grafeas storage backend Mar 9, 2022

wlynch requested changes Mar 17, 2022

View reviewed changes

wlynch requested changes Mar 21, 2022

View reviewed changes

wlynch requested changes Mar 28, 2022

View reviewed changes

Comment thread pkg/chains/storage/grafeas/grafeas_test.go Outdated

Comment thread pkg/chains/storage/grafeas/grafeas.go

Comment thread pkg/chains/storage/grafeas/grafeas_test.go Outdated

Comment thread pkg/chains/storage/grafeas/grafeas_test.go Outdated

wlynch approved these changes Mar 29, 2022

View reviewed changes

tekton-robot assigned priyawadhwa Mar 29, 2022

priyawadhwa reviewed Mar 29, 2022

View reviewed changes

Comment thread pkg/chains/storage/grafeas/grafeas.go

chuangw6 force-pushed the grafeas branch from 126e816 to f0e0387 Compare March 29, 2022 17:44

Add Grafeas storage backend

831ef03

chuangw6 force-pushed the grafeas branch from f0e0387 to 831ef03 Compare March 29, 2022 20:25

priyawadhwa approved these changes Mar 29, 2022

View reviewed changes

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 29, 2022

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 29, 2022

tekton-robot merged commit 9e91dc9 into tektoncd:main Mar 29, 2022

chuangw6 mentioned this pull request Apr 23, 2022

Add Grafeas as a storage backend #358

Closed

Uh oh!

Conversation

chuangw6 commented Mar 3, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Submitter Checklist

Release Notes

action required

1. configure container analysis as storage backend for taskrun and/or oci artifacts.

2. inform tekton chains project ID and note name that will be used to create occurrences.

3. Authenticate to GCP (if Container Analysis is chosen for the storage backend)

Uh oh!

chuangw6 commented Mar 3, 2022

Uh oh!

tekton-robot commented Mar 3, 2022

Uh oh!

tekton-robot commented Mar 3, 2022

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tekton-robot commented Mar 7, 2022

Uh oh!

tekton-robot commented Mar 7, 2022

Uh oh!

tekton-robot commented Mar 7, 2022

Uh oh!

tekton-robot commented Mar 9, 2022

Uh oh!

chuangw6 commented Mar 9, 2022

Uh oh!

tekton-robot commented Mar 9, 2022

Uh oh!

tekton-robot commented Mar 9, 2022

Uh oh!

tekton-robot commented Mar 9, 2022

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tekton-robot commented Mar 19, 2022

Uh oh!

tekton-robot commented Mar 19, 2022

Uh oh!

tekton-robot commented Mar 19, 2022

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tekton-robot commented Mar 23, 2022

Uh oh!

chuangw6 commented Mar 24, 2022

Uh oh!

tekton-robot commented Mar 25, 2022

Uh oh!

tekton-robot commented Mar 25, 2022

Uh oh!

chuangw6 commented Mar 3, 2022 •

edited

Loading