Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: add buildah param to inject secrets into the build #1099

Merged
merged 5 commits into from
Jul 2, 2024
Merged

feat: add buildah param to inject secrets into the build #1099

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
b7cebec
feat: add buildah param to inject secrets into the build
ralphbean Jun 27, 2024
a0b259a
chore: run hack/generate-buidlah-remote.sh and hack/generate-ta-tasks.sh
ralphbean Jun 27, 2024
d71df9a
Provide default value for optional-secret
ralphbean Jul 1, 2024
64825c4
Rename 'optional' to 'additional'
ralphbean Jul 2, 2024
dfb2cfb
chore: run hack/generate-buidlah-remote.sh and hack/generate-ta-tasks.sh
ralphbean Jul 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions task/buildah-oci-ta/0.1/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ When prefetch-dependencies task was activated it is using its artifacts to run b
## Parameters
|name|description|default value|required|
|---|---|---|---|
|ADDITIONAL_SECRET|Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET|does-not-exist|false|
|ADD_CAPABILITIES|Comma separated list of extra capabilities to add when running 'buildah build'|""|false|
|BUILD_ARGS|Array of --build-arg values ("arg=value" strings)|[]|false|
|BUILD_ARGS_FILE|Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file|""|false|
Expand Down
20 changes: 20 additions & 0 deletions task/buildah-oci-ta/0.1/buildah-oci-ta.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,11 @@ spec:
When [Java dependency rebuild](https://redhat-appstudio.github.io/docs.stonesoup.io/Documentation/main/cli/proc_enabled_java_dependencies.html) is enabled it triggers rebuilds of Java artifacts.
When prefetch-dependencies task was activated it is using its artifacts to run build in hermetic environment.
params:
- name: ADDITIONAL_SECRET
description: Name of a secret which will be made available to the build
with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET
type: string
default: does-not-exist
- name: ADD_CAPABILITIES
description: Comma separated list of extra capabilities to add when
running 'buildah build'
Expand Down Expand Up @@ -131,6 +136,10 @@ spec:
description: The counting of Java components by publisher in JSON format
type: string
volumes:
- name: additional-secret
secret:
optional: true
secretName: $(params.ADDITIONAL_SECRET)
- name: etc-pki-entitlement
secret:
optional: true
Expand All @@ -150,6 +159,8 @@ spec:
emptyDir: {}
stepTemplate:
env:
- name: ADDITIONAL_SECRET
value: $(params.ADDITIONAL_SECRET)
- name: ADD_CAPABILITIES
value: $(params.ADD_CAPABILITIES)
- name: BUILDAH_FORMAT
Expand Down Expand Up @@ -206,6 +217,8 @@ spec:
name: varlibcontainers
- mountPath: /entitlement
name: etc-pki-entitlement
- mountPath: /additional-secret
name: additional-secret
- mountPath: /mnt/trusted-ca
name: trusted-ca
readOnly: true
Expand Down Expand Up @@ -336,6 +349,13 @@ spec:
echo "Adding the entitlement to the build"
fi

ADDITIONAL_SECRET_PATH="/additional-secret"
if [ -d "$ADDITIONAL_SECRET_PATH" ]; then
cp -r --preserve=mode "$ADDITIONAL_SECRET_PATH" /tmp/additional-secret
BUILDAH_ARGS+=("--secret=id=${ADDITIONAL_SECRET},src=/tmp/additional-secret")
echo "Adding the secret ${ADDITIONAL_SECRET} to the build, available at /run/secrets/${ADDITIONAL_SECRET}"
fi
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technically, this allows the user to inject arbitrary content into the build. Although the same could be said for every volume mount unless the content comes from the output of a trusted task. The likelihood of this being misused seems slightly higher than for the other secrets, though still fairly low.

I'm not too concerned over adding this, just raising an observation


unshare -Uf $UNSHARE_ARGS --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w ${SOURCE_CODE_DIR}/$CONTEXT -- buildah build \
$VOLUME_MOUNTS \
"${BUILDAH_ARGS[@]}" \
Expand Down
23 changes: 23 additions & 0 deletions task/buildah-remote-oci-ta/0.1/buildah-remote-oci-ta.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,11 @@ spec:
When [Java dependency rebuild](https://redhat-appstudio.github.io/docs.stonesoup.io/Documentation/main/cli/proc_enabled_java_dependencies.html) is enabled it triggers rebuilds of Java artifacts.
When prefetch-dependencies task was activated it is using its artifacts to run build in hermetic environment.
params:
- default: does-not-exist
description: Name of a secret which will be made available to the build with 'buildah
build --secret' at /run/secrets/$ADDITIONAL_SECRET
name: ADDITIONAL_SECRET
type: string
- default: ""
description: Comma separated list of extra capabilities to add when running 'buildah
build'
Expand Down Expand Up @@ -133,6 +138,8 @@ spec:
stepTemplate:
computeResources: {}
env:
- name: ADDITIONAL_SECRET
value: $(params.ADDITIONAL_SECRET)
- name: ADD_CAPABILITIES
value: $(params.ADD_CAPABILITIES)
- name: BUILDAH_FORMAT
Expand Down Expand Up @@ -226,6 +233,7 @@ spec:
rsync -ra /shared/ "$SSH_HOST:$BUILD_DIR/volumes/shared/"
rsync -ra /var/workdir/ "$SSH_HOST:$BUILD_DIR/volumes/workdir/"
rsync -ra /entitlement/ "$SSH_HOST:$BUILD_DIR/volumes/etc-pki-entitlement/"
rsync -ra /additional-secret/ "$SSH_HOST:$BUILD_DIR/volumes/additional-secret/"
rsync -ra /mnt/trusted-ca/ "$SSH_HOST:$BUILD_DIR/volumes/trusted-ca/"
rsync -ra "$HOME/.docker/" "$SSH_HOST:$BUILD_DIR/.docker/"
rsync -ra "/tekton/results/" "$SSH_HOST:$BUILD_DIR/tekton-results/"
Expand Down Expand Up @@ -357,6 +365,13 @@ spec:
echo "Adding the entitlement to the build"
fi

ADDITIONAL_SECRET_PATH="/additional-secret"
if [ -d "$ADDITIONAL_SECRET_PATH" ]; then
cp -r --preserve=mode "$ADDITIONAL_SECRET_PATH" /tmp/additional-secret
BUILDAH_ARGS+=("--secret=id=${ADDITIONAL_SECRET},src=/tmp/additional-secret")
echo "Adding the secret ${ADDITIONAL_SECRET} to the build, available at /run/secrets/${ADDITIONAL_SECRET}"
fi

unshare -Uf $UNSHARE_ARGS --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w ${SOURCE_CODE_DIR}/$CONTEXT -- buildah build \
$VOLUME_MOUNTS \
"${BUILDAH_ARGS[@]}" \
Expand Down Expand Up @@ -390,6 +405,7 @@ spec:
chmod +x scripts/script-build.sh
rsync -ra scripts "$SSH_HOST:$BUILD_DIR"
ssh $SSH_ARGS "$SSH_HOST" $PORT_FORWARD podman run $PODMAN_PORT_FORWARD \
-e ADDITIONAL_SECRET="$ADDITIONAL_SECRET" \
-e ADD_CAPABILITIES="$ADD_CAPABILITIES" \
-e BUILDAH_FORMAT="$BUILDAH_FORMAT" \
-e BUILD_ARGS_FILE="$BUILD_ARGS_FILE" \
Expand All @@ -411,6 +427,7 @@ spec:
-v "$BUILD_DIR/volumes/shared:/shared:Z" \
-v "$BUILD_DIR/volumes/workdir:/var/workdir:Z" \
-v "$BUILD_DIR/volumes/etc-pki-entitlement:/entitlement:Z" \
-v "$BUILD_DIR/volumes/additional-secret:/additional-secret:Z" \
-v "$BUILD_DIR/volumes/trusted-ca:/mnt/trusted-ca:Z" \
-v "$BUILD_DIR/.docker/:/root/.docker:Z" \
-v "$BUILD_DIR/tekton-results/:/tekton/results:Z" \
Expand All @@ -434,6 +451,8 @@ spec:
name: varlibcontainers
- mountPath: /entitlement
name: etc-pki-entitlement
- mountPath: /additional-secret
name: additional-secret
- mountPath: /mnt/trusted-ca
name: trusted-ca
readOnly: true
Expand Down Expand Up @@ -603,6 +622,10 @@ spec:
name: upload-sbom
workingDir: /var/workdir
volumes:
- name: additional-secret
secret:
optional: true
secretName: $(params.ADDITIONAL_SECRET)
- name: etc-pki-entitlement
secret:
optional: true
Expand Down
23 changes: 23 additions & 0 deletions task/buildah-remote/0.1/buildah-remote.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,11 @@ spec:
description: Name of secret which contains the entitlement certificates
name: ENTITLEMENT_SECRET
type: string
- default: does-not-exist
description: Name of a secret which will be made available to the build with 'buildah
build --secret' at /run/secrets/$ADDITIONAL_SECRET
name: ADDITIONAL_SECRET
type: string
- default: []
description: Array of --build-arg values ("arg=value" strings)
name: BUILD_ARGS
Expand Down Expand Up @@ -156,6 +161,8 @@ spec:
value: $(params.BUILDER_IMAGE)
- name: ENTITLEMENT_SECRET
value: $(params.ENTITLEMENT_SECRET)
- name: ADDITIONAL_SECRET
value: $(params.ADDITIONAL_SECRET)
- name: BUILD_ARGS_FILE
value: $(params.BUILD_ARGS_FILE)
- name: ADD_CAPABILITIES
Expand Down Expand Up @@ -214,6 +221,7 @@ spec:
rsync -ra $(workspaces.source.path)/ "$SSH_HOST:$BUILD_DIR/workspaces/source/"
rsync -ra /shared/ "$SSH_HOST:$BUILD_DIR/volumes/shared/"
rsync -ra /entitlement/ "$SSH_HOST:$BUILD_DIR/volumes/etc-pki-entitlement/"
rsync -ra /additional-secret/ "$SSH_HOST:$BUILD_DIR/volumes/additional-secret/"
rsync -ra /mnt/trusted-ca/ "$SSH_HOST:$BUILD_DIR/volumes/trusted-ca/"
rsync -ra "$HOME/.docker/" "$SSH_HOST:$BUILD_DIR/.docker/"
rsync -ra "/tekton/results/" "$SSH_HOST:$BUILD_DIR/tekton-results/"
Expand Down Expand Up @@ -349,6 +357,13 @@ spec:
echo "Adding the entitlement to the build"
fi

ADDITIONAL_SECRET_PATH="/additional-secret"
if [ -d "$ADDITIONAL_SECRET_PATH" ]; then
cp -r --preserve=mode "$ADDITIONAL_SECRET_PATH" /tmp/additional-secret
BUILDAH_ARGS+=("--secret=id=${ADDITIONAL_SECRET},src=/tmp/additional-secret")
echo "Adding the secret ${ADDITIONAL_SECRET} to the build, available at /run/secrets/${ADDITIONAL_SECRET}"
fi

unshare -Uf $UNSHARE_ARGS --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w ${SOURCE_CODE_DIR}/$CONTEXT -- buildah build \
$VOLUME_MOUNTS \
"${BUILDAH_ARGS[@]}" \
Expand Down Expand Up @@ -396,6 +411,7 @@ spec:
-e TARGET_STAGE="$TARGET_STAGE" \
-e PARAM_BUILDER_IMAGE="$PARAM_BUILDER_IMAGE" \
-e ENTITLEMENT_SECRET="$ENTITLEMENT_SECRET" \
-e ADDITIONAL_SECRET="$ADDITIONAL_SECRET" \
-e BUILD_ARGS_FILE="$BUILD_ARGS_FILE" \
-e ADD_CAPABILITIES="$ADD_CAPABILITIES" \
-e SQUASH="$SQUASH" \
Expand All @@ -404,6 +420,7 @@ spec:
-v "$BUILD_DIR/workspaces/source:$(workspaces.source.path):Z" \
-v "$BUILD_DIR/volumes/shared:/shared:Z" \
-v "$BUILD_DIR/volumes/etc-pki-entitlement:/entitlement:Z" \
-v "$BUILD_DIR/volumes/additional-secret:/additional-secret:Z" \
-v "$BUILD_DIR/volumes/trusted-ca:/mnt/trusted-ca:Z" \
-v "$BUILD_DIR/.docker/:/root/.docker:Z" \
-v "$BUILD_DIR/tekton-results/:/tekton/results:Z" \
Expand All @@ -427,6 +444,8 @@ spec:
name: varlibcontainers
- mountPath: /entitlement
name: etc-pki-entitlement
- mountPath: /additional-secret
name: additional-secret
- mountPath: /mnt/trusted-ca
name: trusted-ca
readOnly: true
Expand Down Expand Up @@ -608,6 +627,10 @@ spec:
secret:
optional: true
secretName: $(params.ENTITLEMENT_SECRET)
- name: additional-secret
secret:
optional: true
secretName: $(params.ADDITIONAL_SECRET)
- configMap:
items:
- key: $(params.caTrustConfigMapKey)
Expand Down
1 change: 1 addition & 0 deletions task/buildah/0.1/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ When prefetch-dependencies task was activated it is using its artifacts to run b
|YUM_REPOS_D_TARGET|Target path on the container in which yum repository files should be made available|/etc/yum.repos.d|false|
|TARGET_STAGE|Target stage in Dockerfile to build. If not specified, the Dockerfile is processed entirely to (and including) its last stage.|""|false|
|ENTITLEMENT_SECRET|Name of secret which contains the entitlement certificates|etc-pki-entitlement|false|
|ADDITIONAL_SECRET|Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET|does-not-exist|false|
|BUILD_ARGS|Array of --build-arg values ("arg=value" strings)|[]|false|
|BUILD_ARGS_FILE|Path to a file with build arguments, see https://www.mankier.com/1/buildah-build#--build-arg-file|""|false|
|SQUASH|Squash new layers added as a part of this build, as per --squash|false|false|
Expand Down
19 changes: 19 additions & 0 deletions task/buildah/0.1/buildah.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,10 @@ spec:
description: Name of secret which contains the entitlement certificates
type: string
default: "etc-pki-entitlement"
- name: ADDITIONAL_SECRET
description: Name of a secret which will be made available to the build with 'buildah build --secret' at /run/secrets/$ADDITIONAL_SECRET
type: string
default: "does-not-exist"
- name: BUILD_ARGS
description: Array of --build-arg values ("arg=value" strings)
type: array
Expand Down Expand Up @@ -145,6 +149,8 @@ spec:
value: $(params.BUILDER_IMAGE)
- name: ENTITLEMENT_SECRET
value: $(params.ENTITLEMENT_SECRET)
- name: ADDITIONAL_SECRET
value: $(params.ADDITIONAL_SECRET)
- name: BUILD_ARGS_FILE
value: $(params.BUILD_ARGS_FILE)
- name: ADD_CAPABILITIES
Expand Down Expand Up @@ -296,6 +302,13 @@ spec:
echo "Adding the entitlement to the build"
fi

ADDITIONAL_SECRET_PATH="/additional-secret"
if [ -d "$ADDITIONAL_SECRET_PATH" ]; then
cp -r --preserve=mode "$ADDITIONAL_SECRET_PATH" /tmp/additional-secret
BUILDAH_ARGS+=("--secret=id=${ADDITIONAL_SECRET},src=/tmp/additional-secret")
echo "Adding the secret ${ADDITIONAL_SECRET} to the build, available at /run/secrets/${ADDITIONAL_SECRET}"
fi

unshare -Uf $UNSHARE_ARGS --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w ${SOURCE_CODE_DIR}/$CONTEXT -- buildah build \
$VOLUME_MOUNTS \
"${BUILDAH_ARGS[@]}" \
Expand Down Expand Up @@ -333,6 +346,8 @@ spec:
name: varlibcontainers
- mountPath: "/entitlement"
name: etc-pki-entitlement
- mountPath: "/additional-secret"
name: additional-secret
- name: trusted-ca
mountPath: /mnt/trusted-ca
readOnly: true
Expand Down Expand Up @@ -515,6 +530,10 @@ spec:
secret:
secretName: $(params.ENTITLEMENT_SECRET)
optional: true
- name: additional-secret
secret:
secretName: $(params.ADDITIONAL_SECRET)
optional: true
- name: trusted-ca
configMap:
name: $(params.caTrustConfigMapName)
Expand Down
Loading