[TEP-0091] change feature flag resource-verification-mode to trusted-resources-verification-no-match-policy #6324

Yongxuanzhang · 2023-03-08T22:07:30Z

Changes

🚨BREAKING CHANGES🚨

This commits changes trusted resources feature flag from resource-verification-mode to verification-no-match-policy. This is a backward incompatiable change as discussed in TEP-0091. Before this commit the feature flag is used to skip/enforce the verification. This commit changes this to check the existence of matched VerificationPolicy. So to enable the verification, users just need to apply VerificationPolicy to match the resources. To disable the verification, users need to remove the policies and set the verification-no-match-policy to ignore (by default).

Part of #6356

/kind feature

Signed-off-by: Yongxuan Zhang yongxuanzhang@google.com

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

Has Docs included if any changes are user facing
Has Tests included if any functionality added or changed
Follows the commit message standard
Meets the Tekton contributor standards (including
functionality, content, code)
Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings)
Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

[action required] for trusted resources users, please change feature flag resource-verification-mode to trusted-resources-verification-no-match-policy, please refer to https://github.com/tektoncd/pipeline/blob/main/docs/trusted-resources.md#enable-trusted-resources to learn how to config the new  trusted-resources-verification-no-match-policy feature flag

tekton-robot · 2023-03-08T22:07:32Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

Yongxuanzhang · 2023-03-08T22:07:40Z

/test all

tekton-robot · 2023-03-08T22:14:01Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	91.8%	-1.7
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	91.4%	-2.3
pkg/reconciler/taskrun/resources/taskref.go	89.9%	90.6%	0.7
pkg/reconciler/taskrun/taskrun.go	84.9%	84.9%	0.0
pkg/trustedresources/verify.go	93.8%	94.2%	0.5

tekton-robot · 2023-03-08T22:16:19Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	91.8%	-1.7
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	91.4%	-2.3
pkg/reconciler/taskrun/resources/taskref.go	89.9%	90.6%	0.7
pkg/reconciler/taskrun/taskrun.go	84.9%	84.9%	0.0
pkg/trustedresources/verify.go	94.4%	94.2%	-0.2

Yongxuanzhang · 2023-03-08T22:24:10Z

/test all

tekton-robot · 2023-03-08T22:29:35Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	91.8%	-1.7
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	91.4%	-2.3
pkg/reconciler/taskrun/resources/taskref.go	89.9%	90.6%	0.7
pkg/reconciler/taskrun/taskrun.go	84.9%	84.9%	0.0
pkg/trustedresources/verify.go	94.4%	94.2%	-0.2

tekton-robot · 2023-03-08T22:31:48Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	91.8%	-1.7
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	91.4%	-2.3
pkg/reconciler/taskrun/resources/taskref.go	89.9%	90.6%	0.7
pkg/reconciler/taskrun/taskrun.go	84.9%	84.9%	0.0
pkg/trustedresources/verify.go	94.4%	94.2%	-0.2

Yongxuanzhang · 2023-03-13T18:22:26Z

/test all

tekton-robot · 2023-03-13T18:28:13Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	91.8%	-1.7
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	91.4%	-2.3
pkg/reconciler/taskrun/resources/taskref.go	89.9%	90.6%	0.7
pkg/reconciler/taskrun/taskrun.go	84.9%	84.9%	0.0
pkg/trustedresources/verify.go	94.4%	94.2%	-0.2

tekton-robot · 2023-03-13T18:29:19Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	91.8%	-1.7
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	91.4%	-2.3
pkg/reconciler/taskrun/resources/taskref.go	89.9%	90.6%	0.7
pkg/reconciler/taskrun/taskrun.go	84.9%	84.9%	0.0
pkg/trustedresources/verify.go	94.4%	94.2%	-0.2

Yongxuanzhang · 2023-03-13T19:02:56Z

/test all

Yongxuanzhang · 2023-03-13T19:07:01Z

/test all

tekton-robot · 2023-03-13T19:11:44Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	91.8%	-1.7
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	91.4%	-2.3
pkg/reconciler/taskrun/resources/taskref.go	89.9%	90.6%	0.7
pkg/reconciler/taskrun/taskrun.go	84.9%	84.9%	0.0
pkg/trustedresources/verify.go	94.4%	94.2%	-0.2

tekton-robot · 2023-03-13T19:13:10Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	91.8%	-1.7
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	91.4%	-2.3
pkg/reconciler/taskrun/resources/taskref.go	89.9%	90.6%	0.7
pkg/reconciler/taskrun/taskrun.go	84.9%	84.9%	0.0
pkg/trustedresources/verify.go	94.4%	94.2%	-0.2

tekton-robot · 2023-03-13T19:15:32Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	90.0%	-3.5
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	91.4%	-2.3
pkg/reconciler/taskrun/resources/taskref.go	89.9%	90.6%	0.7
pkg/reconciler/taskrun/taskrun.go	84.9%	84.9%	0.0
pkg/trustedresources/verify.go	94.4%	94.2%	-0.2

Yongxuanzhang · 2023-03-13T19:32:26Z

/test all

tekton-robot · 2023-03-13T19:38:25Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	91.8%	-1.7
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	91.4%	-2.3
pkg/reconciler/taskrun/resources/taskref.go	89.9%	90.6%	0.7
pkg/reconciler/taskrun/taskrun.go	84.9%	84.9%	0.0
pkg/trustedresources/verify.go	94.4%	94.2%	-0.2

tekton-robot · 2023-03-13T19:48:18Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	91.8%	-1.7
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	91.4%	-2.3
pkg/reconciler/taskrun/resources/taskref.go	89.9%	90.6%	0.7
pkg/reconciler/taskrun/taskrun.go	84.9%	84.9%	0.0
pkg/trustedresources/verify.go	94.4%	94.2%	-0.2

tekton-robot · 2023-03-20T23:10:24Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	93.3%	-0.2
pkg/reconciler/pipelinerun/pipelinerun.go	88.4%	88.4%	0.0
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	93.3%	-0.4
pkg/reconciler/taskrun/resources/taskref.go	89.9%	89.3%	-0.5
pkg/reconciler/taskrun/taskrun.go	84.9%	84.8%	-0.1
pkg/trustedresources/errors.go	Do not exist	75.0%
pkg/trustedresources/verify.go	94.4%	95.1%	0.7

tekton-robot · 2023-03-20T23:15:52Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	93.3%	-0.2
pkg/reconciler/pipelinerun/pipelinerun.go	88.4%	88.4%	0.0
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	93.3%	-0.4
pkg/reconciler/taskrun/resources/taskref.go	89.9%	89.3%	-0.5
pkg/reconciler/taskrun/taskrun.go	84.9%	84.8%	-0.1
pkg/trustedresources/errors.go	Do not exist	75.0%
pkg/trustedresources/verify.go	94.4%	95.1%	0.7

tekton-robot · 2023-03-20T23:16:30Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	93.3%	-0.2
pkg/reconciler/pipelinerun/pipelinerun.go	88.4%	88.4%	0.0
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	93.3%	-0.4
pkg/reconciler/taskrun/resources/taskref.go	89.9%	89.3%	-0.5
pkg/reconciler/taskrun/taskrun.go	84.9%	84.8%	-0.1
pkg/trustedresources/errors.go	Do not exist	75.0%
pkg/trustedresources/verify.go	94.4%	95.1%	0.7

lbernick · 2023-03-21T15:52:53Z

pkg/trustedresources/verify_test.go

+		task                      v1beta1.TaskObject
+		source                    string
+		signer                    signature.SignerVerifier
+		verificationNoMatchPolicy string


I see; in that case it would be helpful to create variables matchingSource and mismatchedSource to serve as better "documentation"

pkg/reconciler/pipelinerun/pipelinerun.go

pkg/reconciler/pipelinerun/resources/pipelineref.go

tekton-robot · 2023-03-21T19:28:48Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	93.3%	-0.2
pkg/reconciler/pipelinerun/pipelinerun.go	88.4%	88.4%	0.0
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	93.1%	-0.6
pkg/reconciler/taskrun/resources/taskref.go	89.9%	89.0%	-0.8
pkg/reconciler/taskrun/taskrun.go	85.0%	84.8%	-0.1
pkg/trustedresources/verify.go	94.4%	95.1%	0.7

tekton-robot · 2023-03-21T19:29:47Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	93.3%	-0.2
pkg/reconciler/pipelinerun/pipelinerun.go	88.4%	88.4%	0.0
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	93.1%	-0.6
pkg/reconciler/taskrun/resources/taskref.go	89.9%	89.0%	-0.8
pkg/reconciler/taskrun/taskrun.go	85.0%	84.8%	-0.1
pkg/trustedresources/verify.go	94.4%	95.1%	0.7

tekton-robot · 2023-03-21T19:34:41Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	93.3%	-0.2
pkg/reconciler/pipelinerun/pipelinerun.go	88.4%	88.4%	0.0
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	93.1%	-0.6
pkg/reconciler/taskrun/resources/taskref.go	89.9%	89.0%	-0.8
pkg/reconciler/taskrun/taskrun.go	85.0%	84.8%	-0.1
pkg/trustedresources/verify.go	94.4%	95.1%	0.7

wlynch

/lgtm

tekton-robot · 2023-03-22T15:30:29Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lbernick, wlynch

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [lbernick,wlynch]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Yongxuanzhang · 2023-03-22T16:05:28Z

/hold
I think @lbernick mentioned there are some comments, I need to double check

This commits changes trusted resources feature flag from resource-verification-mode to verification-no-match-policy. This is a backward imcompatiable change as discussed in TEP--0091. Before this commit the feature flag is used to skip/enforce the verification. This commit changes this to check the existence of matched VerificationPolicy. So to enable the verification, users just need to apply VerificationPolicy to match the resources. To disable the verification, users need to remove the policies and set the verification-no-match-policy to allow (by default). Signed-off-by: Yongxuan Zhang yongxuanzhang@google.com

Yongxuanzhang · 2023-03-22T16:46:09Z

/hold cancel

tekton-robot · 2023-03-22T16:51:43Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	93.3%	-0.2
pkg/reconciler/pipelinerun/pipelinerun.go	88.7%	88.7%	0.0
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	93.1%	-0.6
pkg/reconciler/taskrun/resources/taskref.go	89.9%	89.0%	-0.8
pkg/reconciler/taskrun/taskrun.go	85.0%	84.8%	-0.1
pkg/trustedresources/verify.go	94.4%	95.1%	0.7

tekton-robot · 2023-03-22T16:53:04Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	93.5%	93.3%	-0.2
pkg/reconciler/pipelinerun/pipelinerun.go	88.7%	88.7%	0.0
pkg/reconciler/pipelinerun/resources/pipelineref.go	93.8%	93.1%	-0.6
pkg/reconciler/taskrun/resources/taskref.go	89.9%	89.0%	-0.8
pkg/reconciler/taskrun/taskrun.go	85.0%	84.8%	-0.1
pkg/trustedresources/verify.go	94.4%	95.1%	0.7

QuanZhang-William · 2023-03-22T17:56:30Z

/assign

lbernick · 2023-03-22T18:27:00Z

/lgtm

tekton-robot added kind/feature Categorizes issue or PR as related to a new feature. release-note-none Denotes a PR that doesnt merit a release note. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels Mar 8, 2023

tekton-robot requested review from abayer and bobcatfish March 8, 2023 22:07

tekton-robot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Mar 8, 2023

tekton-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 8, 2023

Yongxuanzhang force-pushed the no-match-policy branch from ecf624b to 7d80953 Compare March 8, 2023 22:23

tekton-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 8, 2023

tekton-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 10, 2023

Yongxuanzhang force-pushed the no-match-policy branch from 7d80953 to 7cf6f5b Compare March 13, 2023 18:22

tekton-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 13, 2023

lbernick self-assigned this Mar 21, 2023

lbernick reviewed Mar 21, 2023

View reviewed changes

Yongxuanzhang force-pushed the no-match-policy branch 2 times, most recently from d29a9eb to b781395 Compare March 21, 2023 19:22

lbernick approved these changes Mar 22, 2023

View reviewed changes

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 22, 2023

wlynch approved these changes Mar 22, 2023

View reviewed changes

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 22, 2023

tekton-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 22, 2023

Yongxuanzhang force-pushed the no-match-policy branch from b781395 to 2d0e0ea Compare March 22, 2023 16:45

tekton-robot removed the lgtm Indicates that a PR is ready to be merged. label Mar 22, 2023

tekton-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 22, 2023

tekton-robot assigned QuanZhang-William Mar 22, 2023

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 22, 2023

tekton-robot merged commit 5deea1f into tektoncd:main Mar 22, 2023

jkandasa mentioned this pull request May 9, 2023

bump pipelines to 0.47, pac to 0.19, and fix breaking changes tektoncd/operator#1481

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[TEP-0091] change feature flag resource-verification-mode to trusted-resources-verification-no-match-policy #6324

[TEP-0091] change feature flag resource-verification-mode to trusted-resources-verification-no-match-policy #6324

Yongxuanzhang commented Mar 8, 2023 •

edited

Loading

tekton-robot commented Mar 8, 2023

Yongxuanzhang commented Mar 8, 2023

tekton-robot commented Mar 8, 2023

tekton-robot commented Mar 8, 2023

Yongxuanzhang commented Mar 8, 2023

tekton-robot commented Mar 8, 2023

tekton-robot commented Mar 8, 2023

Yongxuanzhang commented Mar 13, 2023

tekton-robot commented Mar 13, 2023

tekton-robot commented Mar 13, 2023

Yongxuanzhang commented Mar 13, 2023

Yongxuanzhang commented Mar 13, 2023

tekton-robot commented Mar 13, 2023

tekton-robot commented Mar 13, 2023

tekton-robot commented Mar 13, 2023

Yongxuanzhang commented Mar 13, 2023

tekton-robot commented Mar 13, 2023

tekton-robot commented Mar 13, 2023

tekton-robot commented Mar 20, 2023

tekton-robot commented Mar 20, 2023

tekton-robot commented Mar 20, 2023

lbernick Mar 21, 2023

tekton-robot commented Mar 21, 2023

tekton-robot commented Mar 21, 2023

tekton-robot commented Mar 21, 2023

wlynch left a comment

tekton-robot commented Mar 22, 2023

Yongxuanzhang commented Mar 22, 2023 •

edited

Loading

Yongxuanzhang commented Mar 22, 2023

tekton-robot commented Mar 22, 2023

tekton-robot commented Mar 22, 2023

QuanZhang-William commented Mar 22, 2023

lbernick commented Mar 22, 2023

[TEP-0091] change feature flag resource-verification-mode to trusted-resources-verification-no-match-policy #6324

[TEP-0091] change feature flag resource-verification-mode to trusted-resources-verification-no-match-policy #6324

Conversation

Yongxuanzhang commented Mar 8, 2023 • edited Loading

Changes

Submitter Checklist

Release Notes

tekton-robot commented Mar 8, 2023

Yongxuanzhang commented Mar 8, 2023

tekton-robot commented Mar 8, 2023

tekton-robot commented Mar 8, 2023

Yongxuanzhang commented Mar 8, 2023

tekton-robot commented Mar 8, 2023

tekton-robot commented Mar 8, 2023

Yongxuanzhang commented Mar 13, 2023

tekton-robot commented Mar 13, 2023

tekton-robot commented Mar 13, 2023

Yongxuanzhang commented Mar 13, 2023

Yongxuanzhang commented Mar 13, 2023

tekton-robot commented Mar 13, 2023

tekton-robot commented Mar 13, 2023

tekton-robot commented Mar 13, 2023

Yongxuanzhang commented Mar 13, 2023

tekton-robot commented Mar 13, 2023

tekton-robot commented Mar 13, 2023

tekton-robot commented Mar 20, 2023

tekton-robot commented Mar 20, 2023

tekton-robot commented Mar 20, 2023

lbernick Mar 21, 2023

Choose a reason for hiding this comment

tekton-robot commented Mar 21, 2023

tekton-robot commented Mar 21, 2023

tekton-robot commented Mar 21, 2023

wlynch left a comment

Choose a reason for hiding this comment

tekton-robot commented Mar 22, 2023

Yongxuanzhang commented Mar 22, 2023 • edited Loading

Yongxuanzhang commented Mar 22, 2023

tekton-robot commented Mar 22, 2023

tekton-robot commented Mar 22, 2023

QuanZhang-William commented Mar 22, 2023

lbernick commented Mar 22, 2023

Yongxuanzhang commented Mar 8, 2023 •

edited

Loading

Yongxuanzhang commented Mar 22, 2023 •

edited

Loading