Add CSI and Projected Workspace to V1

pkg/apis/pipeline/v1/swagger.json

@@ -1266,6 +1266,10 @@
           "description": "ConfigMap represents a configMap that should populate this workspace.",
           "$ref": "#/definitions/v1.ConfigMapVolumeSource"
         },
+        "csi": {
+          "description": "CSI (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers.",
+          "$ref": "#/definitions/v1.CSIVolumeSource"
+        },
         "emptyDir": {
           "description": "EmptyDir represents a temporary directory that shares a Task's lifetime. More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir Either this OR PersistentVolumeClaim can be used.",
           "$ref": "#/definitions/v1.EmptyDirVolumeSource"
@@ -1279,6 +1283,10 @@
           "description": "PersistentVolumeClaimVolumeSource represents a reference to a PersistentVolumeClaim in the same namespace. Either this OR EmptyDir can be used.",
           "$ref": "#/definitions/v1.PersistentVolumeClaimVolumeSource"
         },
+        "projected": {
+          "description": "Projected represents a projected volume that should populate this workspace.",
+          "$ref": "#/definitions/v1.ProjectedVolumeSource"
+        },
         "secret": {
           "description": "Secret represents a secret that should populate this workspace.",
           "$ref": "#/definitions/v1.SecretVolumeSource"

pkg/apis/pipeline/v1/workspace_types.go

@@ -77,6 +77,12 @@ type WorkspaceBinding struct {
 	// Secret represents a secret that should populate this workspace.
 	// +optional
 	Secret *corev1.SecretVolumeSource `json:"secret,omitempty"`
+	// Projected represents a projected volume that should populate this workspace.
+	// +optional
+	Projected *corev1.ProjectedVolumeSource `json:"projected,omitempty"`
+	// CSI (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers.
+	// +optional
+	CSI *corev1.CSIVolumeSource `json:"csi,omitempty"`
 }
 
 // WorkspacePipelineDeclaration creates a named slot in a Pipeline that a PipelineRun

pkg/apis/pipeline/v1/workspace_validation.go

@@ -19,6 +19,8 @@ package v1
 import (
 	"context"
 
+	"github.com/tektoncd/pipeline/pkg/apis/config"
+	"github.com/tektoncd/pipeline/pkg/apis/version"
 	"k8s.io/apimachinery/pkg/api/equality"
 	"knative.dev/pkg/apis"
 )
@@ -36,7 +38,7 @@ var allVolumeSourceFields = []string{
 // Validate looks at the Volume provided in wb and makes sure that it is valid.
 // This means that only one VolumeSource can be specified, and also that the
 // supported VolumeSource is itself valid.
-func (b *WorkspaceBinding) Validate(context.Context) *apis.FieldError {
+func (b *WorkspaceBinding) Validate(ctx context.Context) (errs *apis.FieldError) {
 	if equality.Semantic.DeepEqual(b, &WorkspaceBinding{}) || b == nil {
 		return apis.ErrMissingField(apis.CurrentField)
 	}
@@ -66,6 +68,29 @@ func (b *WorkspaceBinding) Validate(context.Context) *apis.FieldError {
 		return apis.ErrMissingField("secret.secretName")
 	}
 
+	// The projected workspace is only supported when the alpha feature gate is enabled.
+	// For a Projected volume to work, you must provide at least one source.
+	if b.Projected != nil {
+		if err := version.ValidateEnabledAPIFields(ctx, "projected workspace type", config.AlphaAPIFields).ViaField("workspace"); err != nil {
+			return err
+		}
+		if len(b.Projected.Sources) == 0 {
+			return apis.ErrMissingField("projected.sources")
+		}
+	}
+
+	// The csi workspace is only supported when the alpha feature gate is enabled.
+	// For a CSI to work, you must provide and have installed the driver to use.
+	if b.CSI != nil {
+		errs := version.ValidateEnabledAPIFields(ctx, "csi workspace type", config.AlphaAPIFields).ViaField("workspaces")
+		if errs != nil {
+			return errs
+		}
+		if b.CSI.Driver == "" {
+			return apis.ErrMissingField("csi.driver")
+		}
+	}
+
 	return nil
 }
 
@@ -88,5 +113,11 @@ func (b *WorkspaceBinding) numSources() int {
 	if b.Secret != nil {
 		n++
 	}
+	if b.Projected != nil {
+		n++
+	}
+	if b.CSI != nil {
+		n++
+	}
 	return n
 }

pkg/apis/pipeline/v1/workspace_validation_test.go

@@ -20,6 +20,7 @@ import (
 	"context"
 	"testing"
 
+	"github.com/tektoncd/pipeline/pkg/apis/config"
 	v1 "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
@@ -30,6 +31,7 @@ func TestWorkspaceBindingValidateValid(t *testing.T) {
 	for _, tc := range []struct {
 		name    string
 		binding *v1.WorkspaceBinding
+		wc      func(context.Context) context.Context
 	}{{
 		name: "Valid PVC",
 		binding: &v1.WorkspaceBinding{
@@ -80,9 +82,43 @@ func TestWorkspaceBindingValidateValid(t *testing.T) {
 				SecretName: "my-secret",
 			},
 		},
+	}, {
+		name: "Valid projected",
+		binding: &v1.WorkspaceBinding{
+			Name: "beth",
+			Projected: &corev1.ProjectedVolumeSource{
+				Sources: []corev1.VolumeProjection{{
+					ConfigMap: &corev1.ConfigMapProjection{
+						LocalObjectReference: corev1.LocalObjectReference{
+							Name: "a-configmap-name",
+						},
+					},
+				}, {
+					Secret: &corev1.SecretProjection{
+						LocalObjectReference: corev1.LocalObjectReference{
+							Name: "my-secret",
+						},
+					},
+				}},
+			},
+		},
+		wc: config.EnableAlphaAPIFields,
+	}, {
+		name: "Valid csi",
+		binding: &v1.WorkspaceBinding{
+			Name: "beth",
+			CSI: &corev1.CSIVolumeSource{
+				Driver: "my-csi",
+			},
+		},
+		wc: config.EnableAlphaAPIFields,
 	}} {
 		t.Run(tc.name, func(t *testing.T) {
-			if err := tc.binding.Validate(context.Background()); err != nil {
+			ctx := context.Background()
+			if tc.wc != nil {
+				ctx = tc.wc(ctx)
+			}
+			if err := tc.binding.Validate(ctx); err != nil {
 				t.Errorf("didnt expect error for valid binding but got: %v", err)
 			}
 		})
@@ -94,6 +130,7 @@ func TestWorkspaceBindingValidateInvalid(t *testing.T) {
 	for _, tc := range []struct {
 		name    string
 		binding *v1.WorkspaceBinding
+		wc      func(context.Context) context.Context
 	}{{
 		name:    "no binding provided",
 		binding: nil,
@@ -129,9 +166,43 @@ func TestWorkspaceBindingValidateInvalid(t *testing.T) {
 			Name:   "beth",
 			Secret: &corev1.SecretVolumeSource{},
 		},
+	}, {
+		name: "projected workspace should be disallowed without alpha feature gate",
+		binding: &v1.WorkspaceBinding{
+			Name:      "beth",
+			Projected: &corev1.ProjectedVolumeSource{},
+		},
+	}, {
+		name: "Provide projected without sources",
+		binding: &v1.WorkspaceBinding{
+			Name:      "beth",
+			Projected: &corev1.ProjectedVolumeSource{},
+		},
+		wc: config.EnableAlphaAPIFields,
+	}, {
+		name: "csi workspace should be disallowed without alpha feature gate",
+		binding: &v1.WorkspaceBinding{
+			Name: "beth",
+			CSI: &corev1.CSIVolumeSource{
+				Driver: "csi-driver",
+			},
+		},
+	}, {
+		name: "Provide csi without a driver",
+		binding: &v1.WorkspaceBinding{
+			Name: "beth",
+			CSI: &corev1.CSIVolumeSource{
+				Driver: "",
+			},
+		},
+		wc: config.EnableAlphaAPIFields,
 	}} {
 		t.Run(tc.name, func(t *testing.T) {
-			if err := tc.binding.Validate(context.Background()); err == nil {
+			ctx := context.Background()
+			if tc.wc != nil {
+				ctx = tc.wc(ctx)
+			}
+			if err := tc.binding.Validate(ctx); err == nil {
 				t.Errorf("expected error for invalid binding but didn't get any!")
 			}
 		})