Add Rego interceptor

[bobcatfish]

Expected Behavior

In addition to supporting CEL for filtering and mutation of payloads, we can support other options out of the box, such as Rego.

Actual Behavior

We only support CEL, tho folks can bring their own interceptors of course!

Additional Info

To actually make this happen we should propose a design since there are a few ways we could express filtering + overlays with Rego.

This is a POC of a Rego interceptor. It uses a filter query and an overlay query which provides the same functionality as this example CEL interceptor.

Preview of the rego syntax:

  triggers:
    - name: rego-trig-with-matches
      interceptors:
        - github:
            secretRef:
              secretName: webhook-secret
              secretKey: secret
        - rego:
            source: |
              package main
              default filter = false
              filter {
                input.header[k][i] == "pull_request"
                lower(k) == "x-github-event"
              }
              
              default overlay = {}
              overlay = {
                "extensions": {
                   "truncated_sha": substring(input.body.pull_request.head.sha, 0, 7),
                }
              }
      bindings:
      - name: rego-binding
      template:
        name: rego-trigger-template

This yaml is an example that uses the pullrequest task to comment on a PR when it is opened.

[dibyom]

/kind feature

[tekton-robot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

/close

Send feedback to tektoncd/plumbing.

[tekton-robot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.

/lifecycle rotten

Send feedback to tektoncd/plumbing.

[tekton-robot]

@tekton-robot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

/close

Send feedback to tektoncd/plumbing.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[afrittoli]

/remove-lifecycle rotten

[afrittoli]

I think this would be a really cool feature to have, since it would enable managing an reusing policies - which with CEL can only be copy/pasted across event listeners.

Once example would be filtering GitHub webhook events based on the user and type of events, which can be used to restrict access to github comment commands like "/test" to individuals in a certain group.

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[tekton-robot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle rotten

Send feedback to tektoncd/plumbing.

[jmcshane]

/remove-lifecycle rotten

[jmcshane]

with the work done for the v0.13 release, I think this is a great time to invest in further interceptor patterns.

I'm going to take a look at the previous implementation by @bobcatfish and see how it can be adapted into the current deployment structure for the triggers-core-interceptors. With the plugin model, we could make this an optional alpha feature for some time and even allow it to be deployed separately within a triggers deployment.

[jmcshane]

I took a slightly different approach now that we can allow for arbitrary JSON parameters in an interceptor expression. The base module is set at data.tekton and the rego filter will run data.tekton.filter.

You can then write additional queries based off that initial compiled module (which we then only have to compile once). Those queries will be evaluated and binding variables will locate each match to become a set of extension keys. I put some notes in the docs, but maybe it will be best to bring the solution to WG soon.

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[tekton-robot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle rotten

Send feedback to tektoncd/plumbing.

[tekton-robot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen with a justification.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/close

Send feedback to tektoncd/plumbing.

[tekton-robot]

@tekton-robot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen with a justification.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/close

Send feedback to tektoncd/plumbing.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.