Skip to content

Commit 142a144

Browse files
simonbairdclaude
simonbaird
and
claude
committed
Add new task to collect keyless signing params
Ref: https://redhat.atlassian.net/browse/EC-1695 Co-authored-by: Claude Code <noreply@anthropic.com>
1 parent 9dde861 commit 142a144

5 files changed

Lines changed: 394 additions & 0 deletions

File tree

‎docs/modules/ROOT/pages/collect-keyless-signing-params.adoc‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
= collect-keyless-signing-params
2+
3+
Version: 0.1
4+
5+
== Synopsis
6+
7+
Tekton task to collect Konflux configuration parameters related to
8+
keyless signing using cosign. The task attempts to read the "cluster-config"
9+
ConfigMap in the "konflux-info" namespace to extract signing parameters.
10+
11+
In case the ConfigMap is not found, the task will output empty strings for all parameters,
12+
allowing the pipeline to continue without signing parameters.
13+
14+
15+
== Params
16+
[horizontal]
17+
18+
*configMapName* (`string`):: The name of the ConfigMap to read signing parameters from
19+
+
20+
*Default*: `cluster-config`
21+
*configMapNamespace* (`string`):: The namespace where the ConfigMap is located
22+
+
23+
*Default*: `konflux-info`
24+
25+
== Results
26+
27+
[horizontal]
28+
*defaultOIDCIssuer*:: A default OIDC issuer URL to be used for signing.
29+
30+
*rekorExternalUrl*:: The external URL of the Rekor transparency log.
31+
32+
*fulcioExternalUrl*:: The external URL of the Fulcio certificate authority.
33+
34+
*tufExternalUrl*:: The external URL of the TUF repository.
35+
36+
*buildIdentity*:: The build identity from the OIDC token claims, if applicable.
37+
38+
*buildIdentityRegexp*:: A regular expression to extract build identity from the OIDC token claims, if applicable.
39+
40+
*keylessSigningEnabled*:: A flag indicating whether keyless signing is enabled based on the presence of signing parameters.
41+

‎docs/modules/ROOT/partials/tasks_nav.adoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
* xref:tasks.adoc[Tekton Tasks]
2+
** xref:collect-keyless-signing-params.adoc[collect-keyless-signing-params]
23
** xref:verify-conforma-konflux-ta.adoc[verify-conforma-konflux-ta]
34
** xref:verify-conforma-vsa-release-ta.adoc[verify-conforma-vsa-release-ta]
45
** xref:verify-enterprise-contract.adoc[verify-enterprise-contract]

‎features/__snapshots__/task_validate_image.snap‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -552,3 +552,70 @@ results.buildIdentity: https://kubernetes.io/namespaces/openshift-pipelines/serv
552552
results.buildIdentityRegexp: ^https://konflux-ci.dev/.*$
553553

554554
---
555+
556+
[Collect keyless signing parameters when there is a malformed ConfigMap:collect-signing-params - 1]
557+
Reading ConfigMap konflux-info/cluster-config-3
558+
ConfigMap found, extracting keyless signing parameters
559+
enableKeylessSigning is not set, using default empty values
560+
results.keylessSigningEnabled: false
561+
results.defaultOIDCIssuer:
562+
results.rekorExternalUrl:
563+
results.fulcioExternalUrl:
564+
results.tufExternalUrl:
565+
results.buildIdentity:
566+
results.buildIdentityRegexp:
567+
568+
---
569+
570+
[Collect keyless signing parameters when the namespace does not exist:collect-signing-params - 1]
571+
Reading ConfigMap doesnt-exist-namespace/whatever
572+
ConfigMap not found, using default empty values
573+
results.keylessSigningEnabled: false
574+
results.defaultOIDCIssuer:
575+
results.rekorExternalUrl:
576+
results.fulcioExternalUrl:
577+
results.tufExternalUrl:
578+
results.buildIdentity:
579+
results.buildIdentityRegexp:
580+
581+
---
582+
583+
[Collect keyless signing parameters when the ConfigMap does not exist:collect-signing-params - 1]
584+
Reading ConfigMap konflux-info/doesnt-exist-config
585+
ConfigMap not found, using default empty values
586+
results.keylessSigningEnabled: false
587+
results.defaultOIDCIssuer:
588+
results.rekorExternalUrl:
589+
results.fulcioExternalUrl:
590+
results.tufExternalUrl:
591+
results.buildIdentity:
592+
results.buildIdentityRegexp:
593+
594+
---
595+
596+
[Collect keyless signing parameters from ConfigMap with keyless signing disabled:collect-signing-params - 1]
597+
Reading ConfigMap konflux-info/cluster-config-2
598+
ConfigMap found, extracting keyless signing parameters
599+
enableKeylessSigning is not set, using default empty values
600+
results.keylessSigningEnabled: false
601+
results.defaultOIDCIssuer:
602+
results.rekorExternalUrl:
603+
results.fulcioExternalUrl:
604+
results.tufExternalUrl:
605+
results.buildIdentity:
606+
results.buildIdentityRegexp:
607+
608+
---
609+
610+
[Collect keyless signing parameters from ConfigMap:collect-signing-params - 1]
611+
Reading ConfigMap konflux-info/cluster-config
612+
ConfigMap found, extracting keyless signing parameters
613+
results.keylessSigningEnabled: true
614+
results.defaultOIDCIssuer: https://kubernetes.default.svc.cluster.local
615+
results.rekorExternalUrl: https://rekor.example.com
616+
results.fulcioExternalUrl: https://fulcio.example.com
617+
results.tufExternalUrl: https://tuf.example.com
618+
results.buildIdentity: https://kubernetes.io/namespaces/openshift-pipelines/serviceaccounts/tekton-chains-controller
619+
results.buildIdentityRegexp: ^https://konflux-ci.dev/.*$
620+
621+
---

‎features/task_validate_image.feature‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -318,3 +318,121 @@ Feature: Verify Enterprise Contract Tekton Tasks
318318
Then the task should succeed
319319
And the task logs for step "detailed-report" should match the snapshot
320320
And the task results should match the snapshot
321+
322+
Scenario: Collect keyless signing parameters from ConfigMap
323+
Given a working namespace
324+
And a namespace named "konflux-info" exists
325+
# Note: These scenarios might run in parallel so let's use a different config map
326+
# for each scenario so we don't have to worry about them clashing with each other
327+
And a ConfigMap "cluster-config" in namespace "konflux-info" with content:
328+
"""
329+
{
330+
"defaultOIDCIssuer": "https://kubernetes.default.svc.cluster.local",
331+
"rekorExternalUrl": "https://rekor.example.com",
332+
"fulcioExternalUrl": "https://fulcio.example.com",
333+
"tufExternalUrl": "https://tuf.example.com",
334+
"buildIdentity": "https://kubernetes.io/namespaces/openshift-pipelines/serviceaccounts/tekton-chains-controller",
335+
"buildIdentityRegexp": "^https://konflux-ci.dev/.*$",
336+
"enableKeylessSigning": "true"
337+
}
338+
"""
339+
When version 0.1 of the task named "collect-keyless-signing-params" is run with parameters:
340+
| configMapName | cluster-config |
341+
Then the task should succeed
342+
And the task logs for step "collect-signing-params" should match the snapshot
343+
And the task result "defaultOIDCIssuer" should equal "https://kubernetes.default.svc.cluster.local"
344+
And the task result "rekorExternalUrl" should equal "https://rekor.example.com"
345+
And the task result "fulcioExternalUrl" should equal "https://fulcio.example.com"
346+
And the task result "tufExternalUrl" should equal "https://tuf.example.com"
347+
And the task result "buildIdentity" should equal "https://kubernetes.io/namespaces/openshift-pipelines/serviceaccounts/tekton-chains-controller"
348+
And the task result "buildIdentityRegexp" should equal "^https://konflux-ci.dev/.*$"
349+
And the task result "keylessSigningEnabled" should equal "true"
350+
351+
Scenario: Collect keyless signing parameters from ConfigMap with keyless signing disabled
352+
Given a working namespace
353+
And a namespace named "konflux-info" exists
354+
# Note: These scenarios might run in parallel so let's use a different config map
355+
# for each scenario so we don't have to worry about them clashing with each other
356+
And a ConfigMap "cluster-config-2" in namespace "konflux-info" with content:
357+
"""
358+
{
359+
"defaultOIDCIssuer": "https://kubernetes.default.svc.cluster.local",
360+
"rekorExternalUrl": "https://rekor.example.com",
361+
"fulcioExternalUrl": "https://fulcio.example.com",
362+
"tufExternalUrl": "https://tuf.example.com",
363+
"buildIdentity": "https://kubernetes.io/namespaces/openshift-pipelines/serviceaccounts/tekton-chains-controller",
364+
"buildIdentityRegexp": "^https://konflux-ci.dev/.*$",
365+
"enableKeylessSigning": "false"
366+
}
367+
"""
368+
When version 0.1 of the task named "collect-keyless-signing-params" is run with parameters:
369+
| configMapName | cluster-config-2 |
370+
Then the task should succeed
371+
And the task logs for step "collect-signing-params" should match the snapshot
372+
And the task result "defaultOIDCIssuer" should equal ""
373+
And the task result "rekorExternalUrl" should equal ""
374+
And the task result "fulcioExternalUrl" should equal ""
375+
And the task result "tufExternalUrl" should equal ""
376+
And the task result "buildIdentity" should equal ""
377+
And the task result "buildIdentityRegexp" should equal ""
378+
And the task result "keylessSigningEnabled" should equal "false"
379+
380+
Scenario: Collect keyless signing parameters when there is a malformed ConfigMap
381+
Given a working namespace
382+
And a namespace named "konflux-info" exists
383+
# Note: These scenarios might run in parallel so let's use a different config map
384+
# for each scenario so we don't have to worry about them clashing with each other
385+
And a ConfigMap "cluster-config-3" in namespace "konflux-info" with content:
386+
"""
387+
{"foo": "bar"}
388+
"""
389+
When version 0.1 of the task named "collect-keyless-signing-params" is run with parameters:
390+
| configMapName | cluster-config-3 |
391+
Then the task should succeed
392+
And the task logs for step "collect-signing-params" should match the snapshot
393+
And the task result "defaultOIDCIssuer" should equal ""
394+
And the task result "rekorExternalUrl" should equal ""
395+
And the task result "fulcioExternalUrl" should equal ""
396+
And the task result "tufExternalUrl" should equal ""
397+
And the task result "buildIdentity" should equal ""
398+
And the task result "buildIdentityRegexp" should equal ""
399+
And the task result "keylessSigningEnabled" should equal "false"
400+
401+
Scenario: Collect keyless signing parameters when the ConfigMap does not exist
402+
Given a working namespace
403+
And a namespace named "konflux-info" exists
404+
# Note: These scenarios might run in parallel so let's use a different config map
405+
# for each scenario so we don't have to worry about them clashing with each other.
406+
# Creating a config map deliberately so we are sure the rbac is created. (I might
407+
# be wrong but I think it could matter if this secenario runs before any of the
408+
# others.)
409+
And a ConfigMap "cluster-config-4" in namespace "konflux-info" with content:
410+
"""
411+
{"foo": "bar"}
412+
"""
413+
When version 0.1 of the task named "collect-keyless-signing-params" is run with parameters:
414+
| configMapNamespace | konflux-info |
415+
| configMapName | doesnt-exist-config |
416+
Then the task should succeed
417+
And the task logs for step "collect-signing-params" should match the snapshot
418+
And the task result "defaultOIDCIssuer" should equal ""
419+
And the task result "rekorExternalUrl" should equal ""
420+
And the task result "fulcioExternalUrl" should equal ""
421+
And the task result "tufExternalUrl" should equal ""
422+
And the task result "buildIdentityRegexp" should equal ""
423+
And the task result "keylessSigningEnabled" should equal "false"
424+
425+
Scenario: Collect keyless signing parameters when the namespace does not exist
426+
Given a working namespace
427+
When version 0.1 of the task named "collect-keyless-signing-params" is run with parameters:
428+
| configMapNamespace | doesnt-exist-namespace |
429+
| configMapName | whatever |
430+
Then the task should succeed
431+
And the task logs for step "collect-signing-params" should match the snapshot
432+
And the task result "defaultOIDCIssuer" should equal ""
433+
And the task result "rekorExternalUrl" should equal ""
434+
And the task result "fulcioExternalUrl" should equal ""
435+
And the task result "tufExternalUrl" should equal ""
436+
And the task result "buildIdentity" should equal ""
437+
And the task result "buildIdentityRegexp" should equal ""
438+
And the task result "keylessSigningEnabled" should equal "false"

0 commit comments

Comments
 (0)