tektoncd / chains

Supply Chain Security in Tekton Pipelines
Apache License 2.0
249 stars 135 forks source link

`artifacts.pipelinerun.storage` does not support `docdb` #869

Closed bradbeck closed 1 year ago

bradbeck commented 1 year ago

Expected Behavior

The documentation suggests that artifacts.pipelinerun.storage accepts docdb.

https://tekton.dev/docs/chains/config/#pipelinerun-configuration

Actual Behavior

The chains controller will not start if artifacts.pipelinerun.storage includes docdb.

{"level":"fatal","ts":"2023-07-19T19:18:16.118Z","logger":"watcher","caller":"configmap/store.go:150","msg":"Error initializing chains config \"chains-config\": \"failed to parse data: invalid value \\\"docdb\\\" wanted one of [grafeas oci tekton]\"","stacktrace":"github.com/tektoncd/chains/vendor/knative.dev/pkg/configmap.(*UntypedStore).OnConfigChanged\n\tgithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap/store.go:150\ngithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap.(*ManualWatcher).OnChange\n\tgithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap/manual_watcher.go:72\ngithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap/informer.(*InformedWatcher).addConfigMapEvent\n\tgithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap/informer/informed_watcher.go:220\ngithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap/informer.(*syncedCallback).Call\n\tgithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap/informer/synced_callback.go:94\ngithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap/informer.(*InformedWatcher).Start.func1\n\tgithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap/informer/informed_watcher.go:158\ngithub.com/tektoncd/chains/vendor/k8s.io/client-go/tools/cache.ResourceEventHandlerFuncs.OnAdd\n\tgithub.com/tektoncd/chains/vendor/k8s.io/client-go/tools/cache/controller.go:232\ngithub.com/tektoncd/chains/vendor/k8s.io/client-go/tools/cache.(*processorListener).run.func1\n\tgithub.com/tektoncd/chains/vendor/k8s.io/client-go/tools/cache/shared_informer.go:816\ngithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait.BackoffUntil.func1\n\tgithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:157\ngithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait.BackoffUntil\n\tgithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:158\ngithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait.JitterUntil\n\tgithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:135\ngithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait.Until\n\tgithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:92\ngithub.com/tektoncd/chains/vendor/k8s.io/client-go/tools/cache.(*processorListener).run\n\tgithub.com/tektoncd/chains/vendor/k8s.io/client-go/tools/cache/shared_informer.go:810\ngithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait.(*Group).Start.func1\n\tgithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:75"}

Steps to Reproduce the Problem

  1. kubectl apply --filename https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml
  2. kubectl apply --filename https://storage.googleapis.com/tekton-releases/chains/latest/release.yaml
  3. kubectl patch cm chains-config -n tekton-chains --type strategic --patch '{"data":{"artifacts.pipelinerun.storage":"docdb"}}'
  4. kubectl rollout restart -n tekton-chains deployment tekton-chains-controller
$ kubectl logs -n tekton-chains -l app=tekton-chains-controller
...
{"level":"fatal","ts":"2023-07-19T19:18:16.118Z","logger":"watcher","caller":"configmap/store.go:150","msg":"Error initializing chains config \"chains-config\": \"failed to parse data: invalid value \\\"docdb\\\" wanted one of [grafeas oci tekton]\"","stacktrace":"github.com/tektoncd/chains/vendor/knative.dev/pkg/configmap.(*UntypedStore).OnConfigChanged\n\tgithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap/store.go:150\ngithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap.(*ManualWatcher).OnChange\n\tgithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap/manual_watcher.go:72\ngithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap/informer.(*InformedWatcher).addConfigMapEvent\n\tgithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap/informer/informed_watcher.go:220\ngithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap/informer.(*syncedCallback).Call\n\tgithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap/informer/synced_callback.go:94\ngithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap/informer.(*InformedWatcher).Start.func1\n\tgithub.com/tektoncd/chains/vendor/knative.dev/pkg/configmap/informer/informed_watcher.go:158\ngithub.com/tektoncd/chains/vendor/k8s.io/client-go/tools/cache.ResourceEventHandlerFuncs.OnAdd\n\tgithub.com/tektoncd/chains/vendor/k8s.io/client-go/tools/cache/controller.go:232\ngithub.com/tektoncd/chains/vendor/k8s.io/client-go/tools/cache.(*processorListener).run.func1\n\tgithub.com/tektoncd/chains/vendor/k8s.io/client-go/tools/cache/shared_informer.go:816\ngithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait.BackoffUntil.func1\n\tgithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:157\ngithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait.BackoffUntil\n\tgithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:158\ngithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait.JitterUntil\n\tgithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:135\ngithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait.Until\n\tgithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:92\ngithub.com/tektoncd/chains/vendor/k8s.io/client-go/tools/cache.(*processorListener).run\n\tgithub.com/tektoncd/chains/vendor/k8s.io/client-go/tools/cache/shared_informer.go:810\ngithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait.(*Group).Start.func1\n\tgithub.com/tektoncd/chains/vendor/k8s.io/apimachinery/pkg/util/wait/wait.go:75"}
...

Additional Info

bradbeck commented 1 year ago

The documentation does not appear to reflect the allowed settings here: https://github.com/tektoncd/chains/blob/main/pkg/config/config.go#L261

wlynch commented 1 year ago

It looks like the docdb backend is agnostic to the underlying type: https://github.com/tektoncd/chains/blob/9e69778c77dd0308a19dfdf9484bff0fd65e13d8/pkg/chains/storage/docdb/docdb.go#L62-L82

This might be as simple as adding docdb to the pipelinerun config set + adding tests.