FIPS Compliance: Refactor Entrypoint, Remove zap Dependency & Update Build Checks #8544

PuneetPunamiya · 2025-01-31T05:23:50Z

The Pipelines entrypoint is the only remaining component of Pipelines that is not yet FIPS compliant. It needs to be compiled statically, but currently, it includes crypto symbols
Hence, to make Tekton Pipelines FIPS compliant, the entrypoint command is a key step in this effort. Since it is statically compiled, we must ensure that cryptographic symbols are removed from the entrypoint binary.
The patch includes following changes
- Removes zap and dependency where k8s API are included
- Moves pipelines types to apis/pipeline/v1/types
- Refactor and split metrics and adds disable_tls flag
- Adds a build check in Github Actions CI Workflow

Fixes: #8531 (one part of the issue)

Changes

This patch uses logging with the standard library instead of using zap to ensure that we are not pulling in too many indirect dependencies into the entrypoint through the uber-go/zap module
The corev1 API package is now split because it imports crypto-related functions
Add a build tag disable_tls to conditionally exclude crypto related dependencies

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

Has Docs if any changes are user facing, including updates to minimum requirements e.g. Kubernetes version bumps
Has Tests included if any functionality added or changed
pre-commit Passed
Follows the commit message standard
Meets the Tekton contributor standards (including functionality, content, code)
Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings). See some examples of good release notes.
Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

NONE

PuneetPunamiya · 2025-01-31T05:25:35Z

/kind-cleanup

tekton-robot · 2025-01-31T05:50:28Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/entrypoint/entrypointer.go	88.1%	87.7%	-0.3

tekton-robot · 2025-01-31T05:51:47Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/entrypoint/entrypointer.go	88.1%	87.5%	-0.6

tekton-robot · 2025-01-31T05:54:08Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/entrypoint/entrypointer.go	88.1%	87.5%	-0.6

PuneetPunamiya · 2025-01-31T06:09:58Z

/test check-pr-has-kind-label

tekton-robot · 2025-01-31T06:10:01Z

@PuneetPunamiya: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test pull-tekton-pipeline-build-tests
/test pull-tekton-pipeline-unit-tests

The following commands are available to trigger optional jobs:

/test pull-tekton-pipeline-go-coverage

Use /test all to run all jobs.

In response to this:

/test check-pr-has-kind-label

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

PuneetPunamiya · 2025-01-31T06:18:00Z

/retest

PuneetPunamiya · 2025-01-31T06:21:42Z

/test check-pr-has-kind-label

tekton-robot · 2025-01-31T06:21:44Z

@PuneetPunamiya: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/test pull-tekton-pipeline-build-tests
/test pull-tekton-pipeline-unit-tests

The following commands are available to trigger optional jobs:

/test pull-tekton-pipeline-go-coverage

Use /test all to run all jobs.

In response to this:

/test check-pr-has-kind-label

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

PuneetPunamiya · 2025-01-31T06:22:48Z

/test all

PuneetPunamiya · 2025-01-31T06:23:58Z

/kind cleanup

tekton-robot · 2025-01-31T06:34:29Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/entrypoint/entrypointer.go	88.1%	87.5%	-0.6

l-qing · 2025-02-01T14:10:43Z

pkg/entrypoint/entrypointer.go

@@ -311,7 +307,8 @@ func (e Entrypointer) Go() error {
 			resultPath = e.ResultsDirectory
 		}
 		if err := e.readResultsFromDisk(ctx, resultPath, result.TaskRunResultType); err != nil {
-			logger.Fatalf("Error while handling results: %s", err)
+			slog.Error("Error while substituting step artifacts: ", slog.Any("error", err))
+			return err


I'm curious why log.Fatalf is replaced with logger.Fatalf in other places, but why are slog.Error used in these two instances?

Yeah good catch, I did use log.Fatalf but the issue was it was giving golang lint error as log.Fatalf will exit, and defer cancel() will not run, hence I did use slog.Error

pkg/entrypoint/entrypointer.go

tekton-robot · 2025-02-04T09:24:49Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
cmd/entrypoint/main.go	11.9%	14.3%	2.3
cmd/entrypoint/spire.go	Do not exist	0.0%
pkg/apis/config/feature_flags.go	95.1%	95.0%	-0.1
pkg/apis/config/metrics.go	78.3%	77.3%	-1.0
pkg/apis/config/metrics_tls.go	Do not exist	100.0%
pkg/apis/pipeline/v1/types/artifact_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/artifact_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/artifact_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/param_types.go	Do not exist	81.0%
pkg/apis/pipeline/v1/types/param_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/param_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/results_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/results_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/results_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/resultsref.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/resultsref.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/resultsref.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/when_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/when_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/when_types.go	Do not exist	35.5%
pkg/entrypoint/entrypointer.go	88.1%	90.2%	2.2
pkg/entrypoint/spire.go	Do not exist	0.0%
pkg/substitution/replacements.go	Do not exist	100.0%
pkg/substitution/substitution.go	87.6%	86.2%	-1.4
pkg/termination/message/messae.go	Do not exist	0.0%
pkg/termination/message/messae.go	Do not exist	0.0%

tekton-robot · 2025-02-04T09:49:02Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/entrypoint/entrypointer.go	88.1%	87.5%	-0.6

PuneetPunamiya · 2025-02-04T14:09:37Z

/retest

tekton-robot · 2025-03-03T18:09:14Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	95.2%	95.0%	-0.1
pkg/apis/config/metrics.go	78.3%	77.3%	-1.0
pkg/apis/config/metrics_tls.go	Do not exist	100.0%
pkg/apis/pipeline/v1/types/artifacts_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/param_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/result_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/resultsref.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/when_types.go	Do not exist	0.0%
pkg/entrypoint/entrypointer.go	88.0%	87.5%	-0.5
pkg/substitution/replacements.go	Do not exist	100.0%
pkg/substitution/substitution.go	87.6%	86.2%	-1.4

tekton-robot · 2025-03-04T12:22:59Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	95.2%	95.0%	-0.1
pkg/apis/config/metrics.go	78.3%	77.3%	-1.0
pkg/apis/config/metrics_tls.go	Do not exist	100.0%
pkg/apis/pipeline/v1/types/artifacts_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/param_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/result_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/resultsref.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/when_types.go	Do not exist	0.0%
pkg/entrypoint/entrypointer.go	88.0%	87.5%	-0.5
pkg/substitution/replacements.go	Do not exist	100.0%
pkg/substitution/substitution.go	87.6%	86.2%	-1.4

tekton-robot · 2025-03-04T12:36:17Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	95.2%	95.0%	-0.1
pkg/apis/config/metrics.go	78.3%	77.3%	-1.0
pkg/apis/config/metrics_tls.go	Do not exist	100.0%
pkg/apis/pipeline/v1/types/artifacts_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/param_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/result_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/resultsref.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/when_types.go	Do not exist	0.0%
pkg/entrypoint/entrypointer.go	88.0%	87.5%	-0.5
pkg/substitution/replacements.go	Do not exist	100.0%
pkg/substitution/substitution.go	87.6%	86.2%	-1.4

vdemeester · 2025-03-04T12:57:47Z

/retest

.github/workflows/ci.yaml

tekton-robot · 2025-03-04T13:33:35Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
cmd/entrypoint/runner.go	86.2%	84.5%	-1.7
pkg/apis/config/feature_flags.go	95.2%	95.0%	-0.1
pkg/apis/config/metrics.go	78.3%	77.3%	-1.0
pkg/apis/config/metrics_tls.go	Do not exist	100.0%
pkg/apis/pipeline/v1/types/artifacts_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/param_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/result_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/resultsref.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/when_types.go	Do not exist	0.0%
pkg/entrypoint/entrypointer.go	88.0%	87.5%	-0.5
pkg/substitution/replacements.go	Do not exist	100.0%
pkg/substitution/substitution.go	87.6%	86.2%	-1.4

PuneetPunamiya · 2025-03-04T13:38:16Z

/hold cancel

jkhelil · 2025-03-06T10:49:48Z

.github/workflows/ci.yaml

+        go-version-file: "go.mod"
+    - name: build
+      run: |
+        go build -v -tags "disable_spire,disable_tls" ./cmd/entrypoint


maye be we can check the build for tls symbols ?
go tool nm bin/entrypoint | grep -E 'tls'
Or may be we need to check for crypto once Vibhav PR is merged
go tool nm bin/entrypoint | grep -E 'crypto|tls'

@jkhelil yeah I think we could do that in a follow-up PR.

tekton-robot · 2025-03-12T05:48:12Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
cmd/entrypoint/runner.go	82.8%	84.5%	1.7
pkg/apis/config/feature_flags.go	95.2%	95.0%	-0.1
pkg/apis/config/metrics.go	78.3%	77.3%	-1.0
pkg/apis/config/metrics_tls.go	Do not exist	100.0%
pkg/apis/pipeline/v1/types/artifacts_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/param_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/result_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/resultsref.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/when_types.go	Do not exist	0.0%
pkg/entrypoint/entrypointer.go	88.0%	87.5%	-0.5
pkg/substitution/replacements.go	Do not exist	100.0%
pkg/substitution/substitution.go	87.6%	86.2%	-1.4

jkhelil · 2025-03-12T07:01:11Z

/approve

vdemeester

@PuneetPunamiya can you rebase against main branch to make sure it is not gonna cause issues with code generation ?

vdemeester · 2025-03-12T14:47:38Z

.github/workflows/ci.yaml

@@ -26,6 +26,18 @@ jobs:
    - name: build
      run: |
        go build -v ./...
+  buildWithoutTlsAndSpire:


Sorry for the back and forth. And we could probably do this in a follow-up as well, but I feel we could name this buildFips 😛

cmd/entrypoint/runner.go

Signed-off-by: PuneetPunamiya <[email protected]>

This will help to verify the build for entrypoint using `disable_tls` and `disable_spire` flags Signed-off-by: PuneetPunamiya <[email protected]>

tekton-robot · 2025-03-17T11:10:36Z

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/config/feature_flags.go	95.2%	95.0%	-0.1
pkg/apis/config/metrics.go	78.3%	77.3%	-1.0
pkg/apis/config/metrics_tls.go	Do not exist	100.0%
pkg/apis/pipeline/v1/types/artifacts_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/param_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/result_types.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/resultsref.go	Do not exist	0.0%
pkg/apis/pipeline/v1/types/when_types.go	Do not exist	0.0%
pkg/entrypoint/entrypointer.go	88.0%	87.5%	-0.5
pkg/substitution/replacements.go	Do not exist	100.0%
pkg/substitution/substitution.go	87.6%	86.2%	-1.4

tekton-robot · 2025-03-19T13:23:30Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jkhelil, vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [vdemeester]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

waveywaves · 2025-03-19T13:28:26Z

/lgtm

tekton-robot added the release-note-none Denotes a PR that doesnt merit a release note. label Jan 31, 2025

tekton-robot requested review from dibyom and jerop January 31, 2025 05:23

tekton-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jan 31, 2025

PuneetPunamiya force-pushed the remove-zap-logger-from-entrypoint branch 2 times, most recently from b4c40b2 to d2c70d5 Compare January 31, 2025 05:40

tekton-robot added the kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. label Jan 31, 2025

l-qing reviewed Feb 1, 2025

View reviewed changes

pkg/entrypoint/entrypointer.go Outdated Show resolved Hide resolved

tekton-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Feb 4, 2025

PuneetPunamiya force-pushed the remove-zap-logger-from-entrypoint branch from 11834ef to d2c70d5 Compare February 4, 2025 09:35

tekton-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Feb 4, 2025

PuneetPunamiya closed this Feb 4, 2025

PuneetPunamiya force-pushed the remove-zap-logger-from-entrypoint branch from 54b6e02 to 2b76a2d Compare March 4, 2025 12:10

PuneetPunamiya force-pushed the remove-zap-logger-from-entrypoint branch from 2b76a2d to e6ffdb9 Compare March 4, 2025 12:26

vdemeester reviewed Mar 4, 2025

View reviewed changes

.github/workflows/ci.yaml Outdated Show resolved Hide resolved

PuneetPunamiya force-pushed the remove-zap-logger-from-entrypoint branch from e6ffdb9 to fd1176e Compare March 4, 2025 13:23

tekton-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 4, 2025

jkhelil reviewed Mar 6, 2025

View reviewed changes

PuneetPunamiya changed the title ~~Remove the use of go.uber.org/zap in entrypoint's dependent packages and uses log/slog~~ FIPS Compliance: Refactor Entrypoint, Remove zap Dependency & Update Build Checks Mar 10, 2025

PuneetPunamiya force-pushed the remove-zap-logger-from-entrypoint branch from fd1176e to e627e0d Compare March 12, 2025 05:37

vdemeester reviewed Mar 12, 2025

View reviewed changes

PuneetPunamiya added 4 commits March 17, 2025 16:21

cleanup: remove zap and dependency where k8s api are included

760e3ad

Signed-off-by: PuneetPunamiya <[email protected]>

cleanup: move pipeline types

d996aef

Signed-off-by: PuneetPunamiya <[email protected]>

cleanup: refactor to disable metrics

391e29b

Signed-off-by: PuneetPunamiya <[email protected]>

Adds a build check in Github Actions CI workflow

93d3b76

This will help to verify the build for entrypoint using `disable_tls` and `disable_spire` flags Signed-off-by: PuneetPunamiya <[email protected]>

PuneetPunamiya force-pushed the remove-zap-logger-from-entrypoint branch from e627e0d to 93d3b76 Compare March 17, 2025 11:01

vdemeester approved these changes Mar 19, 2025

View reviewed changes

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 19, 2025

tekton-robot assigned waveywaves Mar 19, 2025

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Mar 19, 2025

tekton-robot merged commit 990917d into tektoncd:main Mar 19, 2025
20 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

FIPS Compliance: Refactor Entrypoint, Remove zap Dependency & Update Build Checks #8544

FIPS Compliance: Refactor Entrypoint, Remove zap Dependency & Update Build Checks #8544

PuneetPunamiya commented Jan 31, 2025 •

edited

Loading

PuneetPunamiya commented Jan 31, 2025

tekton-robot commented Jan 31, 2025

tekton-robot commented Jan 31, 2025

tekton-robot commented Jan 31, 2025

PuneetPunamiya commented Jan 31, 2025

tekton-robot commented Jan 31, 2025

PuneetPunamiya commented Jan 31, 2025

PuneetPunamiya commented Jan 31, 2025

tekton-robot commented Jan 31, 2025

PuneetPunamiya commented Jan 31, 2025

PuneetPunamiya commented Jan 31, 2025

tekton-robot commented Jan 31, 2025

l-qing Feb 1, 2025

PuneetPunamiya Mar 3, 2025 •

edited

Loading

tekton-robot commented Feb 4, 2025

tekton-robot commented Feb 4, 2025

PuneetPunamiya commented Feb 4, 2025

tekton-robot commented Mar 3, 2025

tekton-robot commented Mar 4, 2025

tekton-robot commented Mar 4, 2025

vdemeester commented Mar 4, 2025

tekton-robot commented Mar 4, 2025

PuneetPunamiya commented Mar 4, 2025

jkhelil Mar 6, 2025

vdemeester Mar 12, 2025

tekton-robot commented Mar 12, 2025

jkhelil commented Mar 12, 2025

vdemeester left a comment

vdemeester Mar 12, 2025

tekton-robot commented Mar 17, 2025

tekton-robot commented Mar 19, 2025

waveywaves commented Mar 19, 2025

FIPS Compliance: Refactor Entrypoint, Remove zap Dependency & Update Build Checks #8544

FIPS Compliance: Refactor Entrypoint, Remove zap Dependency & Update Build Checks #8544

Conversation

PuneetPunamiya commented Jan 31, 2025 • edited Loading

Changes

Submitter Checklist

Release Notes

PuneetPunamiya commented Jan 31, 2025

tekton-robot commented Jan 31, 2025

tekton-robot commented Jan 31, 2025

tekton-robot commented Jan 31, 2025

PuneetPunamiya commented Jan 31, 2025

tekton-robot commented Jan 31, 2025

PuneetPunamiya commented Jan 31, 2025

PuneetPunamiya commented Jan 31, 2025

tekton-robot commented Jan 31, 2025

PuneetPunamiya commented Jan 31, 2025

PuneetPunamiya commented Jan 31, 2025

tekton-robot commented Jan 31, 2025

l-qing Feb 1, 2025

Choose a reason for hiding this comment

PuneetPunamiya Mar 3, 2025 • edited Loading

Choose a reason for hiding this comment

tekton-robot commented Feb 4, 2025

tekton-robot commented Feb 4, 2025

PuneetPunamiya commented Feb 4, 2025

tekton-robot commented Mar 3, 2025

tekton-robot commented Mar 4, 2025

tekton-robot commented Mar 4, 2025

vdemeester commented Mar 4, 2025

tekton-robot commented Mar 4, 2025

PuneetPunamiya commented Mar 4, 2025

jkhelil Mar 6, 2025

Choose a reason for hiding this comment

vdemeester Mar 12, 2025

Choose a reason for hiding this comment

tekton-robot commented Mar 12, 2025

jkhelil commented Mar 12, 2025

vdemeester left a comment

Choose a reason for hiding this comment

vdemeester Mar 12, 2025

Choose a reason for hiding this comment

tekton-robot commented Mar 17, 2025

tekton-robot commented Mar 19, 2025

waveywaves commented Mar 19, 2025

PuneetPunamiya commented Jan 31, 2025 •

edited

Loading

PuneetPunamiya Mar 3, 2025 •

edited

Loading