TEP-0125: Configmap and Secret as Param Value Source

[rpajay]

No description provided.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: rpajay / name: P Ajay Rao (b934c29, a5dbcdc, 98df7c0)

[jerop]

/kind tep

[dibyom]

/assign @afrittoli
/assign @pxp928

[tekton-robot]

@dibyom: GitHub didn't allow me to assign the following users: pxp928.

Note that only tektoncd members, repo collaborators and people who have commented on this issue/PR can be assigned. Additionally, issues/PRs can only have 10 assignees at the same time.
For more information please see the contributor guide

Details

In response to this:

/assign @afrittoli
/assign @pxp928

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[afrittoli]

This is not what a Param looks like today - it changed with array params and object params:

type Param struct {
	Name  string     `json:"name"`
	Value ParamValue `json:"value"`
}

(...)

type ParamValue struct {
	Type      ParamType `json:"type"` // Represents the stored type of ParamValues.
	StringVal string    `json:"stringVal"`
	// +listType=atomic
	ArrayVal  []string          `json:"arrayVal"`
	ObjectVal map[string]string `json:"objectVal"`
}

[rpajay]

This Param struct is of PipelineRun / TaskRun
not Pipeline / Task

[afrittoli]

Yes, in Task and Pipeline we use ParamSpec, in TaskRun and PipelineRun we use Param

[rpajay]

The target of this TEP to specify the value from config maps and secrets directly in TaskRun / PipelineRun not in Task / Pipeline

[afrittoli]

Yes, indeed, the TEP is about TaskRun and PipelineRun.

If you look at the specification of a PipelineRun, you can it uses a type called Param, which has a name and a ParamValue

The code in your example specifies ArrayOrString for the type of value, but that is not true anymore, value is now of type ParamValue.

type  Param  struct {
  Name string  `json:"name"`
  Value ArrayOrString `json:"value"`
  // Additional field ValueFrom to fetch value from ConfigMap or Secret
  ValueFrom *ValueSource `json:"valueFrom,omitempty" protobuf:"bytes,3,opt,name=valueFrom"`
}

It would be good to define the behaviour for parameters of type array and object

[afrittoli]

Thank you for your proposal! - see my comments inline.

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please ask for approval from afrittoli after the PR has been reviewed.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• teps/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jerop]

/assign

[afrittoli]

/test pull-community-teps-lint

[tekton-robot]

@afrittoli: No presubmit jobs available for tektoncd/community@main

Details

In response to this:

/test pull-community-teps-lint

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[afrittoli]

@rpajay thank you for the updates! There are still some open comments, let me know what you think or if there is anything I can do to help clarify them.

[tekton-robot]

The following Tekton test failed:

Test name	Commit	Details	Required	Rerun command
pull-community-teps-lint	01ad9f9	link	true	/test pull-community-teps-lint

[pritidesai]

API WG - @rpajay please take a look for another round of reviews, thanks!

[lbernick]

param values are stored in cleartext as part of the CRD. Maybe I'm missing something but does this include plans for scrubbing param values that come from secrets?

[afrittoli]

That's a good point @lbernick. If a PipelineRun parameter is passed down to a TaskRun, it could use the same valueFrom syntax, but only when passed alone (i.e. not concatenated to other strings). The TaskRun controller again could use the same syntax for pods, but that would mean that the secret value could only be available to steps as an environment variable. Using secrets with environment variables can be already done today thanks to https://github.com/tektoncd/community/blob/main/teps/0101-env-in-pod-template.md

[pritidesai]

API WG - under review - @rpajay please respond back if possible, appreciate it! Thanks!

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[pritidesai]

API WG - @rpajay do we want to keep this proposal open? Do you need any help?

[tekton-robot]

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle rotten

Send feedback to tektoncd/plumbing.

[tekton-robot]

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen with a justification.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/close

Send feedback to tektoncd/plumbing.

[tekton-robot]

@tekton-robot: Closed this PR.

Details

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen with a justification.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/close

Send feedback to tektoncd/plumbing.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.