Let the user pass a secret via a parameter for SCM API operations when using the git API resolver #7239

chmouel · 2023-10-19T12:36:40Z

We were previously only allowing using a secret from the global configmap, which mean every users on the cluster would have to use the same git value (which could be a security issue).

We now let the user use their own token on their own namespace with the optional "token" and (even more optional) "tokenKey" params.

The fallback will still be the global configmap.

Added a bit logic to make sure we are caching secrets only when user use the token from global configmap. Since we can't ensure for local secrets on namespace may be rotated often.

/kind feature

Changes

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

Has Docs if any changes are user facing, including updates to minimum requirements e.g. Kubernetes version bumps
Has Tests included if any functionality added or changed
Follows the commit message standard
Meets the Tekton contributor standards (including functionality, content, code)
Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings). See some examples of good release notes.
Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

User are now able to pass a secret referencing token (or a tokenKey) for a SCM operation on the git resolver instead of using the global one from the configmap.

chmouel · 2023-10-19T12:38:25Z

/kind feature

chmouel · 2023-10-19T12:38:32Z

/retest

vdemeester

/meow

tekton-robot · 2023-10-19T12:43:22Z

@vdemeester:

In response to this:

/meow

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tekton-robot · 2023-10-19T12:43:26Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [vdemeester]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tekton-robot · 2023-10-19T12:44:32Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/resolution/resolver/git/resolver.go	83.9%	84.6%	0.7

chmouel

I used token and tokenKey to be simple as the params name, let me know if you have another name in mind (like token-secret-ref or something) i don't mind anything and can refactor it if needed

chmouel · 2023-10-19T12:43:42Z

docs/git-resolver.md

@@ -18,8 +18,10 @@ This Resolver responds to type `git`.
 | `url`        | URL of the repo to fetch and clone anonymously. Either `url`, or `repo` (with `org`) must be specified, but not both.  | `https://github.com/tektoncd/catalog.git`                   |
 | `repo`       | The repository to find the resource in. Either `url`, or `repo` (with `org`) must be specified, but not both.          | `pipeline`, `test-infra`                                    |
 | `org`        | The organization to find the repository in. Default can be set in [configuration](#configuration).                     | `tektoncd`, `kubernetes`                                    |
+| `token`      | An optional secret name in the `PipelineRun` namespace to fetch the token from. Defaults to empty, meaning it will try to use the configuration from the global configmap.      | `secret-name`, (empty)  |


not sure if those tables has been 'designed' to handle such long string, let me know if need to short this string a bit to match the formatting

It should be rendered fine. https://tekton.dev/docs/pipelines/git-resolver/

yes :) but I don't know if the rendering handle properly long lines...

(on another note is there a way to run the docs locally? i.e: with hugo or others?)

@afrittoli ^^

tekton-robot · 2023-10-19T12:48:46Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/resolution/resolver/git/resolver.go	83.9%	84.6%	0.7

tekton-robot · 2023-10-26T10:11:03Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/resolution/resolver/git/resolver.go	83.9%	84.6%	0.7

tekton-robot · 2023-10-26T10:11:51Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/resolution/resolver/git/resolver.go	83.9%	84.6%	0.7

docs/git-resolver.md

tekton-robot · 2023-10-27T14:43:12Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/resolution/resolver/git/resolver.go	83.9%	84.6%	0.7

tekton-robot · 2023-10-27T14:43:24Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/resolution/resolver/git/resolver.go	83.9%	84.6%	0.7

tekton-robot · 2023-10-27T15:03:37Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/resolution/resolver/git/resolver.go	83.9%	84.6%	0.7

tekton-robot · 2023-10-27T15:13:25Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/resolution/resolver/git/resolver.go	83.9%	84.6%	0.7

tekton-robot · 2023-10-27T15:16:29Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/resolution/resolver/git/resolver.go	83.9%	84.6%	0.7

We were previously only allowing using a secret from the global configmap, which mean every users on the cluster would have to use the same git value (which could be a security issue). We now let the user use their own token on their own namespace with the optional "token" and (even more optional) "tokenKey" params. The fallback will still be the global configmap. Added a bit logic to make sure we are caching secrets only when user use the token from global configmap. Since we can't ensure for local secrets on namespace may be rotated often. Signed-off-by: Chmouel Boudjnah <chmouel@redhat.com>

tekton-robot · 2023-10-30T06:10:53Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/resolution/resolver/git/resolver.go	83.9%	84.6%	0.7

tekton-robot · 2023-10-30T06:14:25Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/resolution/resolver/git/resolver.go	83.9%	84.6%	0.7

jerop

/lgtm

🎉

tekton-robot added the release-note-none Denotes a PR that doesnt merit a release note. label Oct 19, 2023

tekton-robot requested review from abayer and pritidesai October 19, 2023 12:36

tekton-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed release-note-none Denotes a PR that doesnt merit a release note. labels Oct 19, 2023

tekton-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Oct 19, 2023

vdemeester approved these changes Oct 19, 2023

View reviewed changes

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 19, 2023

chmouel commented Oct 19, 2023

View reviewed changes

chmouel changed the title ~~Let the user pass a secret for on git API resolver~~ Let the user pass a secret via a parameter for SCM API operations when using the git API resolver Oct 20, 2023

jerop reviewed Oct 27, 2023

View reviewed changes

docs/git-resolver.md Show resolved Hide resolved

chmouel force-pushed the allow-passing-api-token-secret-from-namespace-in-resolver branch from a553e9e to 1025878 Compare October 27, 2023 14:34

chmouel force-pushed the allow-passing-api-token-secret-from-namespace-in-resolver branch from 1025878 to 3923413 Compare October 27, 2023 14:55

chmouel force-pushed the allow-passing-api-token-secret-from-namespace-in-resolver branch from 3923413 to 0b4994f Compare October 27, 2023 15:07

chmouel force-pushed the allow-passing-api-token-secret-from-namespace-in-resolver branch from 0b4994f to 170ce5b Compare October 30, 2023 06:04

jerop reviewed Oct 30, 2023

View reviewed changes

tekton-robot assigned jerop Oct 30, 2023

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Oct 30, 2023

tekton-robot merged commit aa793d3 into tektoncd:main Oct 30, 2023
12 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Let the user pass a secret via a parameter for SCM API operations when using the git API resolver #7239

Let the user pass a secret via a parameter for SCM API operations when using the git API resolver #7239

chmouel commented Oct 19, 2023 •

edited

chmouel commented Oct 19, 2023

chmouel commented Oct 19, 2023

vdemeester left a comment

tekton-robot commented Oct 19, 2023

tekton-robot commented Oct 19, 2023

tekton-robot commented Oct 19, 2023

chmouel left a comment •

edited

chmouel Oct 19, 2023

khrm Oct 26, 2023

chmouel Oct 26, 2023

vdemeester Oct 27, 2023

tekton-robot commented Oct 19, 2023

tekton-robot commented Oct 26, 2023

tekton-robot commented Oct 26, 2023

tekton-robot commented Oct 27, 2023

tekton-robot commented Oct 27, 2023

tekton-robot commented Oct 27, 2023

tekton-robot commented Oct 27, 2023

tekton-robot commented Oct 27, 2023

tekton-robot commented Oct 30, 2023

tekton-robot commented Oct 30, 2023

jerop left a comment

Let the user pass a secret via a parameter for SCM API operations when using the git API resolver #7239

Let the user pass a secret via a parameter for SCM API operations when using the git API resolver #7239

Conversation

chmouel commented Oct 19, 2023 • edited

Changes

Submitter Checklist

Release Notes

chmouel commented Oct 19, 2023

chmouel commented Oct 19, 2023

vdemeester left a comment

Choose a reason for hiding this comment

tekton-robot commented Oct 19, 2023

tekton-robot commented Oct 19, 2023

tekton-robot commented Oct 19, 2023

chmouel left a comment • edited

Choose a reason for hiding this comment

chmouel Oct 19, 2023

Choose a reason for hiding this comment

khrm Oct 26, 2023

Choose a reason for hiding this comment

chmouel Oct 26, 2023

Choose a reason for hiding this comment

vdemeester Oct 27, 2023

Choose a reason for hiding this comment

tekton-robot commented Oct 19, 2023

tekton-robot commented Oct 26, 2023

tekton-robot commented Oct 26, 2023

tekton-robot commented Oct 27, 2023

tekton-robot commented Oct 27, 2023

tekton-robot commented Oct 27, 2023

tekton-robot commented Oct 27, 2023

tekton-robot commented Oct 27, 2023

tekton-robot commented Oct 30, 2023

tekton-robot commented Oct 30, 2023

jerop left a comment

Choose a reason for hiding this comment

chmouel commented Oct 19, 2023 •

edited

chmouel left a comment •

edited