[TEP-0089] Add a config map to support SPIRE initialization. #5902

jagathprakash · 2022-12-20T21:52:37Z

This PR is one among the set of PRs done to implement TEP-0089.
This PR has been derived from the larger PRs PR#5715 and PR#4759 by
@pxp928 and @lumjjb.

This PR is addressing the problem of non-falisfiable provenance discussed in TEP-0089
SPIRE is a tool which provides cryptographic identities to workloads in a cluster.
These identities are also associated with a key pair, which can be used to
sign TaskRun results to track if they have been modified by other workloads.

Using SPIRE is one of the ways to address non-falsifiable provenance.

This PR has the following changes

Modify the feature flag to control non-falsifiability from enable-spire to enforce-nonfalsifiability="spire".
This is in accordance to the approved TEP.
Add a configmap config-spire to initialize SPIRE.

Signed-off-by: jagathprakash 31057312+jagathprakash@users.noreply.github.com

Changes

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

[] Has Docs included if any changes are user facing
Has Tests included if any functionality added or changed
Follows the commit message standard
Meets the Tekton contributor standards (including
functionality, content, code)
Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings)
Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

A new configMap spire-config has been introduced in this PR. This configMap has the following details
- spire-trust-domain: specifies the SPIRE trust domain to use.
- spire-socket-path: specifies the SPIRE agent socket for SPIFFE workload API.
- spire-server-addr: specifies the SPIRE server address for workload/node registration.
- spire-node-alias-prefix: specifies the SPIRE node alias prefix to use.
  These are the details of an existing SPIRE deployment. This implies that SPIRE should be up and running if the SPIRE features has to be used. For now this PR is just adding a configMap and as such does nothing, but later the configMap will be used to initialize the SPIRE client.
The feature flag gating this feature was previously called "enable-spire" and it was a boolean flag. This has now been changed to "enforce-nonfalsifiablity" which is a string and takes the strings "" (which is none) or "spire". This is in conformance to TEP-0089.

jagathprakash · 2022-12-20T21:52:58Z

/kind feature

jagathprakash · 2022-12-20T21:53:48Z

/assign @bobcatfish

jagathprakash · 2022-12-20T21:54:45Z

/assign @afrittoli

jagathprakash · 2022-12-20T21:55:02Z

/assign @lumjjb @pxp928

tekton-robot · 2022-12-20T21:55:03Z

@jagathprakash: GitHub didn't allow me to assign the following users: lumjjb, pxp928.

Note that only tektoncd members, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

In response to this:

/assign @lumjjb @pxp928

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tekton-robot · 2022-12-20T21:59:10Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	86.7%	88.8%	2.1
pkg/apis/config/spire_config.go	Do not exist	88.2%
test/controller.go	28.1%	28.8%	0.6

tekton-robot · 2022-12-20T21:59:49Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-using-tekton to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	86.7%	88.8%	2.1
pkg/apis/config/spire_config.go	Do not exist	88.2%
test/controller.go	28.1%	28.8%	0.6

jagathprakash · 2022-12-20T22:12:25Z

/test tekton-pipeline-unit-tests

jagathprakash · 2022-12-20T22:33:59Z

/test pull-tekton-pipeline-alpha-integration-tests

jagathprakash · 2022-12-21T16:25:52Z

/retest

tekton-robot · 2023-01-05T19:21:50Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	86.7%	88.8%	2.1
pkg/apis/config/spire_config.go	Do not exist	88.2%
test/controller.go	28.5%	29.1%	0.6

tekton-robot · 2023-01-05T19:23:31Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-using-tekton to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	86.7%	88.8%	2.1
pkg/apis/config/spire_config.go	Do not exist	88.2%
test/controller.go	28.5%	29.1%	0.6

tekton-robot · 2023-01-05T20:20:36Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	86.7%	88.8%	2.1
pkg/apis/config/spire_config.go	Do not exist	88.2%
test/controller.go	28.5%	29.1%	0.6

tekton-robot · 2023-01-05T20:22:01Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-using-tekton to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	86.7%	88.8%	2.1
pkg/apis/config/spire_config.go	Do not exist	88.2%
test/controller.go	28.5%	29.1%	0.6

Yongxuanzhang

just one minor comment

Yongxuanzhang · 2023-01-05T22:00:43Z

pkg/apis/config/spire_config_test.go

+		if d := cmp.Diff(got, want); d != "" {
+			t.Errorf("Diff:\n%s", diff.PrintWantGot(d))


this should be cmp.Diff(want, got) since we use PrintWantGot?

Agree. Thanks for finding this.

tekton-robot · 2023-01-06T21:49:02Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	86.7%	88.8%	2.1
pkg/apis/config/spire_config.go	Do not exist	88.2%
test/controller.go	28.5%	29.1%	0.6

tekton-robot · 2023-01-26T20:35:42Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	87.3%	89.5%	2.2
pkg/apis/config/spire_config.go	Do not exist	88.2%
test/controller.go	28.5%	29.1%	0.6

tekton-robot · 2023-01-26T20:36:46Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	87.3%	89.5%	2.2
pkg/apis/config/spire_config.go	Do not exist	88.2%
test/controller.go	28.5%	29.1%	0.6

bobcatfish · 2023-01-26T23:15:30Z

Thanks for all the back and forth!

/approve

tekton-robot · 2023-01-26T23:15:39Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bobcatfish

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [bobcatfish]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Yongxuanzhang · 2023-01-27T15:29:41Z

/lgtm

bobcatfish · 2023-01-27T16:48:32Z

Looks like there is a rebasing problem stopping this from merging @jagathprakash

Also looks like there are a bunch of commits in this PR that should probably be squashed together before merging, plus a merge commit that we wouldn't want to include. Putting a hold on this just to make sure that gets resolved before merging, feel free to remove after the commits are fixed:

/hold

tekton-robot · 2023-01-30T16:08:54Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	87.3%	89.6%	2.3
pkg/apis/config/spire_config.go	Do not exist	88.2%
pkg/apis/config/store.go	100.0%	87.0%	-13.0
test/controller.go	28.5%	29.1%	0.6

tekton-robot · 2023-01-30T16:10:50Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	87.3%	89.6%	2.3
pkg/apis/config/spire_config.go	Do not exist	88.2%
pkg/apis/config/store.go	100.0%	87.0%	-13.0
test/controller.go	28.5%	29.1%	0.6

@pxp928

This PR is one among the set of PRs done to implement TEP-0089. This PR has been derived from the larger PRs PR#5715 and PR#4759 by @pxp928 and @lumjjb. This PR is addressing the problem of non-falisfiable provenance discussed in TEP-0089. SPIRE is a tool which provides cryptographic identities to workloads in a cluster. These identities are also associated with a key pair, which can be used to sign TaskRun results to track if they have been modified by other workloads. Using SPIRE is one of the ways to address non-falsifiable provenance. This PR has the following changes 1. Modify the feature flag to control non-falsifiability from enable-spire to enforce-nonfalsifiability="spire". This is in accordance to the approved TEP. 2. Add a configmap config-spire to initialize SPIRE. Signed-off-by: jagathprakash <31057312+jagathprakash@users.noreply.github.com>

tekton-robot · 2023-01-30T16:24:47Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	87.3%	89.5%	2.2
pkg/apis/config/spire_config.go	Do not exist	88.2%
test/controller.go	28.5%	29.1%	0.6

tekton-robot · 2023-01-30T16:26:36Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	87.3%	89.5%	2.2
pkg/apis/config/spire_config.go	Do not exist	88.2%
test/controller.go	28.5%	29.1%	0.6

Yongxuanzhang · 2023-01-30T17:19:13Z

/lgtm

jagathprakash · 2023-01-30T17:26:05Z

/hold cancel

tekton-robot added the release-note-none Denotes a PR that doesnt merit a release note. label Dec 20, 2022

tekton-robot requested review from dibyom and dlorenc December 20, 2022 21:52

tekton-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Dec 20, 2022

tekton-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Dec 20, 2022

tekton-robot assigned bobcatfish Dec 20, 2022

tekton-robot assigned afrittoli Dec 20, 2022

jagathprakash closed this Jan 5, 2023

jagathprakash reopened this Jan 5, 2023

jagathprakash force-pushed the spire-config-map branch from 6c9dfac to faf549a Compare January 5, 2023 20:15

Yongxuanzhang reviewed Jan 5, 2023

View reviewed changes

jagathprakash force-pushed the spire-config-map branch from faf549a to 5c16c6f Compare January 6, 2023 21:43

tekton-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 9, 2023

jagathprakash force-pushed the spire-config-map branch from 5c16c6f to 2a67379 Compare January 9, 2023 22:21

tekton-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 9, 2023

jagathprakash force-pushed the spire-config-map branch from d77ff51 to c2dfbe8 Compare January 26, 2023 20:30

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 26, 2023

tekton-robot assigned Yongxuanzhang Jan 27, 2023

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Jan 27, 2023

tekton-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 27, 2023

jagathprakash force-pushed the spire-config-map branch from c2dfbe8 to f0c6edb Compare January 30, 2023 16:03

tekton-robot removed the lgtm Indicates that a PR is ready to be merged. label Jan 30, 2023

jagathprakash force-pushed the spire-config-map branch from f0c6edb to ab7af7f Compare January 30, 2023 16:19

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Jan 30, 2023

tekton-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 30, 2023

tekton-robot merged commit bcabd01 into tektoncd:main Jan 30, 2023

jerop mentioned this pull request Feb 14, 2023

[TEP-0089] SPIRE for non-falsifiable provenance. #6160

Closed

7 tasks

jagathprakash mentioned this pull request Feb 21, 2023

[TEP-0089] Enable SPIRE for signing taskrun results in alpha. #5715

Closed

7 tasks

This was referenced Apr 12, 2023

[TEP-0089] SPIRE for non-falsifiable provenance - IsSpireEnabled #6524

Merged

[TEP-0089] Add CSI volumes to the Pods which provide the SPIRE workload API #6539

Merged

This was referenced Apr 28, 2023

[TEP-0089] Enforce non-falsifiable provenance using SPIRE #6597

Open

[TEP-0089] SPIRE for non-falsifiable provenance. Setup the test environment. #6553

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[TEP-0089] Add a config map to support SPIRE initialization. #5902

[TEP-0089] Add a config map to support SPIRE initialization. #5902

jagathprakash commented Dec 20, 2022 •

edited

Loading

jagathprakash commented Dec 20, 2022

jagathprakash commented Dec 20, 2022

jagathprakash commented Dec 20, 2022

jagathprakash commented Dec 20, 2022

tekton-robot commented Dec 20, 2022

tekton-robot commented Dec 20, 2022

tekton-robot commented Dec 20, 2022

jagathprakash commented Dec 20, 2022

jagathprakash commented Dec 20, 2022

jagathprakash commented Dec 21, 2022

tekton-robot commented Jan 5, 2023

tekton-robot commented Jan 5, 2023

tekton-robot commented Jan 5, 2023

tekton-robot commented Jan 5, 2023

Yongxuanzhang left a comment

Yongxuanzhang Jan 5, 2023

jagathprakash Jan 6, 2023

tekton-robot commented Jan 6, 2023

tekton-robot commented Jan 26, 2023

tekton-robot commented Jan 26, 2023

bobcatfish commented Jan 26, 2023

tekton-robot commented Jan 26, 2023

Yongxuanzhang commented Jan 27, 2023

bobcatfish commented Jan 27, 2023

tekton-robot commented Jan 30, 2023

tekton-robot commented Jan 30, 2023

tekton-robot commented Jan 30, 2023

tekton-robot commented Jan 30, 2023

Yongxuanzhang commented Jan 30, 2023

jagathprakash commented Jan 30, 2023

		if d := cmp.Diff(got, want); d != "" {
		t.Errorf("Diff:\n%s", diff.PrintWantGot(d))

[TEP-0089] Add a config map to support SPIRE initialization. #5902

[TEP-0089] Add a config map to support SPIRE initialization. #5902

Conversation

jagathprakash commented Dec 20, 2022 • edited Loading

Changes

Submitter Checklist

Release Notes

jagathprakash commented Dec 20, 2022

jagathprakash commented Dec 20, 2022

jagathprakash commented Dec 20, 2022

jagathprakash commented Dec 20, 2022

tekton-robot commented Dec 20, 2022

tekton-robot commented Dec 20, 2022

tekton-robot commented Dec 20, 2022

jagathprakash commented Dec 20, 2022

jagathprakash commented Dec 20, 2022

jagathprakash commented Dec 21, 2022

tekton-robot commented Jan 5, 2023

tekton-robot commented Jan 5, 2023

tekton-robot commented Jan 5, 2023

tekton-robot commented Jan 5, 2023

Yongxuanzhang left a comment

Choose a reason for hiding this comment

Yongxuanzhang Jan 5, 2023

Choose a reason for hiding this comment

jagathprakash Jan 6, 2023

Choose a reason for hiding this comment

tekton-robot commented Jan 6, 2023

tekton-robot commented Jan 26, 2023

tekton-robot commented Jan 26, 2023

bobcatfish commented Jan 26, 2023

tekton-robot commented Jan 26, 2023

Yongxuanzhang commented Jan 27, 2023

bobcatfish commented Jan 27, 2023

tekton-robot commented Jan 30, 2023

tekton-robot commented Jan 30, 2023

tekton-robot commented Jan 30, 2023

tekton-robot commented Jan 30, 2023

Yongxuanzhang commented Jan 30, 2023

jagathprakash commented Jan 30, 2023

jagathprakash commented Dec 20, 2022 •

edited

Loading