Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cleanup: breakup the pkg/credentials into writer and matcher + ensure non corev1 usage in entrypoint for FIPs compliance #8542

Merged
merged 1 commit into from
Mar 20, 2025
Merged

cleanup: breakup the pkg/credentials into writer and matcher + ensure non corev1 usage in entrypoint for FIPs compliance #8542

merged 1 commit into from
Mar 20, 2025

Conversation

waveywaves
Copy link
Member

@waveywaves waveywaves commented Jan 30, 2025 •
edited
Loading

Changes

The credentials package contains the a matcher and a writer which out of which only the writer is used in cmd/entrypoint. In an effort to isolate usage and not indirectly import the corev1 api which the matcher uses for MatchingAnnotations, we are breaking up the credentials builder interface into two builders for writer and matcher.

This ensures that the entrypoint only uses the writer and not the matcher, and we are only using either the writer or the matcher functionality as necessary and not importing unnecessary deps.

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

  • Has Docs if any changes are user facing, including updates to minimum requirements e.g. Kubernetes version bumps
  • Has Tests included if any functionality added or changed
  • pre-commit Passed
  • Follows the commit message standard
  • Meets the Tekton contributor standards (including functionality, content, code)
  • Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
  • Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings). See some examples of good release notes.
  • Release notes contains the string "action required" if the change requires additional action from users switching to the new release

/kind cleanup

Release Notes

import only the writer part of the credentials package in the entrypoint so that we do not pull core v1 API indirectly into the package

@tekton-robot
Copy link
Collaborator

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@tekton-robot tekton-robot added kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jan 30, 2025
@tekton-robot tekton-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Jan 30, 2025
@waveywaves waveywaves mentioned this pull request Jan 30, 2025
Closed
4 tasks
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/gitcreds/creds.go 94.7% 94.4% -0.3
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 100.0%
pkg/credentials/matcher/matcher.go Do not exist 100.0%
pkg/credentials/matcher/matcher.go Do not exist 20.0%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

vdemeester
vdemeester reviewed Jan 30, 2025
View reviewed changes
Copy link
Member

@vdemeester vdemeester left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good start ❤️ Needs a bit more work but it's definitely going into the right direction.

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/gitcreds/creds.go 94.7% 94.4% -0.3
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 100.0%
pkg/credentials/matcher/matcher.go Do not exist 50.0%
pkg/credentials/matcher/matcher.go Do not exist 20.0%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@waveywaves waveywaves marked this pull request as ready for review February 3, 2025 11:23
jkhelil
jkhelil reviewed Feb 3, 2025
View reviewed changes
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/gitcreds/creds.go 94.7% 94.4% -0.3
pkg/credentials/matcher/matcher.go Do not exist 100.0%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 100.0%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 50.0%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@vdemeester
Copy link
Member

/retest

1 similar comment
@vdemeester
Copy link
Member

/retest

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/gitcreds/creds.go 94.7% 94.4% -0.3
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 100.0%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 20.0%
pkg/credentials/matcher/matcher.go Do not exist 100.0%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@waveywaves waveywaves force-pushed the cleanup/entrypoint-credentials-fips branch 3 times, most recently from 0e86d08 to ecfd3a3 Compare February 12, 2025 18:25
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/gitcreds/basic.go 89.3% 88.2% -1.1
pkg/credentials/gitcreds/creds.go 94.7% 94.4% -0.3
pkg/credentials/gitcreds/ssh.go 88.5% 87.1% -1.4
pkg/credentials/matcher/matcher.go Do not exist 43.8%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 87.5%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 43.8%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@waveywaves
Copy link
Member Author

waveywaves commented Feb 12, 2025 •
edited
Loading

@vdemeester @jkhelil PTAL 🙏

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/gitcreds/creds.go 94.7% 94.4% -0.3
pkg/credentials/matcher/matcher.go Do not exist 87.5%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 87.5%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 43.8%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/gitcreds/creds.go 94.7% 94.4% -0.3
pkg/credentials/gitcreds/ssh.go 88.5% 87.1% -1.4
pkg/credentials/matcher/matcher.go Do not exist 43.8%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 87.5%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 43.8%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/matcher/matcher.go Do not exist 87.5%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 43.8%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 43.8%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@waveywaves waveywaves force-pushed the cleanup/entrypoint-credentials-fips branch from ecfd3a3 to 03eec53 Compare February 19, 2025 12:08
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@waveywaves waveywaves force-pushed the cleanup/entrypoint-credentials-fips branch from 8a76dbd to 4ccc489 Compare February 19, 2025 20:29
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@tekton-robot tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 26, 2025
@vdemeester vdemeester removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 26, 2025
@jkhelil
Copy link
Member

jkhelil commented Feb 26, 2025

/approve

@tekton-robot tekton-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 3, 2025
@waveywaves waveywaves force-pushed the cleanup/entrypoint-credentials-fips branch from 4ccc489 to b9d05a7 Compare March 4, 2025 00:25
@tekton-robot tekton-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 4, 2025
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@vdemeester
Copy link
Member

/retest

@vdemeester
Copy link
Member

cc @afrittoli @chitrangpatel

@jkhelil
Copy link
Member

jkhelil commented Mar 6, 2025

/approve

@tekton-robot
Copy link
Collaborator

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jkhelil, vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@vdemeester
Copy link
Member

@afrittoli 🙃

afrittoli
afrittoli reviewed Mar 17, 2025
View reviewed changes
Copy link
Member

@afrittoli afrittoli left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! It looks mostly good, just a couple of comments.

@waveywaves waveywaves force-pushed the cleanup/entrypoint-credentials-fips branch from b9d05a7 to ccf64eb Compare March 19, 2025 13:40
@waveywaves waveywaves changed the title cleanup: breakup the pkg/credentials into writer and matcher cleanup: breakup the pkg/credentials into writer and matcher + ensure non corev1 usage in entrypoint for FIPs compliance Mar 19, 2025
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@waveywaves
cleanup: breakup the pkg/credentials into writer and matcher
d5d7992 
The credentials package contains the a matcher and a writer which out of
which only the writer is used in cmd/entrypoint. In an effort to isolate
usage and not indirectly import the corev1 api which the matcher uses
for MatchingAnnotations, we are breaking up the credentials builder interface
into two builders for writer and matcher.

This ensures that the entrypoint only uses the writer and not the matcher,
and we are only using either the writer or the matcher functionality
as necessary and not importing unnecessary deps.

cleanup: use better names for the credentials interfaces

cleanup: use CredsDir from entrypoint pkg instead of pipeline

cleanup: remove corev1 usage from credentials package

cleanup: add goling gosec exception for Secret type constants
@waveywaves waveywaves force-pushed the cleanup/entrypoint-credentials-fips branch from ccf64eb to d5d7992 Compare March 19, 2025 14:07
@tekton-robot tekton-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Mar 19, 2025
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/matcher/matcher.go Do not exist 75.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

afrittoli
afrittoli reviewed Mar 20, 2025
View reviewed changes
pkg/credentials/matcher/matcher_test.go
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

afrittoli
afrittoli reviewed Mar 20, 2025
View reviewed changes
Copy link
Member

@afrittoli afrittoli left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the tests and clarifications.
/lgtm

@tekton-robot tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 20, 2025
@tekton-robot tekton-robot merged commit a8a8c81 into tektoncd:main Mar 20, 2025
20 checks passed
@waveywaves
Copy link
Member Author

@afrittoli thank you for catching the lack of tests and going through the problem statement 😄 appreciate it 🙂

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vdemeester vdemeester vdemeester approved these changes

@afrittoli afrittoli afrittoli left review comments

@jkhelil jkhelil jkhelil left review comments

@pritidesai pritidesai Awaiting requested review from pritidesai

Assignees

@afrittoli afrittoli

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm Indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files.
Projects
Tekton Community Roadmap
Status: Done
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@waveywaves @tekton-robot @vdemeester @jkhelil @afrittoli