Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(taskrun): emit warning for missing secret in ServiceAccount instead of failing #7761

Merged
merged 1 commit into from
Apr 25, 2024
Merged

fix(taskrun): emit warning for missing secret in ServiceAccount instead of failing #7761

merged 1 commit into from
Apr 25, 2024

Conversation

l-qing
Copy link
Contributor

@l-qing l-qing commented Mar 17, 2024

fix #7760

Log a warning if a Secrets in service account does not exist

Changes

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

  • Has Docs if any changes are user facing, including updates to minimum requirements e.g. Kubernetes version bumps
  • Has Tests included if any functionality added or changed
  • pre-commit Passed
  • Follows the commit message standard
  • Meets the Tekton contributor standards (including functionality, content, code)
  • Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
  • Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings). See some examples of good release notes.
  • Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

fix(taskrun): emit warning for missing secret in ServiceAccount instead of failing

/kind bug

@tekton-robot tekton-robot added kind/bug Categorizes issue or PR as related to a bug. release-note Denotes a PR that will be considered when it comes time to generate release notes. labels Mar 17, 2024
@tekton-robot tekton-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Mar 17, 2024
@tekton-robot
Copy link
Collaborator

Hi @l-qing. Thanks for your PR.

I'm waiting for a tektoncd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/pod/creds_init.go 93.9% 94.9% 1.0

@l-qing l-qing force-pushed the fix/handle-missing-secret-gracefully branch from 3833963 to cf93527 Compare March 18, 2024 13:56
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/pod/creds_init.go 93.9% 94.9% 1.0

@l-qing l-qing force-pushed the fix/handle-missing-secret-gracefully branch from cf93527 to 9b649ae Compare March 19, 2024 06:56
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/pod/creds_init.go 93.9% 94.9% 1.0

@l-qing l-qing force-pushed the fix/handle-missing-secret-gracefully branch from 9b649ae to 16f4ccf Compare March 19, 2024 14:32
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/pod/creds_init.go 93.9% 94.9% 1.0

@l-qing
Copy link
Contributor Author

l-qing commented Mar 20, 2024

/auto-cc

@tekton-robot tekton-robot requested review from abayer and dibyom March 20, 2024 06:19
@l-qing l-qing force-pushed the fix/handle-missing-secret-gracefully branch from 16f4ccf to 7bc44a4 Compare March 21, 2024 15:57
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/pod/creds_init.go 93.9% 94.9% 1.0

@l-qing
Copy link
Contributor Author

l-qing commented Mar 22, 2024

/auto-cc

@tekton-robot tekton-robot requested a review from bobcatfish March 22, 2024 13:01
khrm
khrm reviewed Mar 27, 2024
View reviewed changes
Copy link
Contributor

@khrm khrm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/ok-to-test

@tekton-robot tekton-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 27, 2024
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/pod/creds_init.go 93.9% 94.9% 1.0

@l-qing l-qing force-pushed the fix/handle-missing-secret-gracefully branch from 7bc44a4 to 0a981b9 Compare April 3, 2024 05:59
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/pod/creds_init.go 93.9% 94.9% 1.0

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/pod/creds_init.go 93.9% 94.9% 1.0

@l-qing l-qing force-pushed the fix/handle-missing-secret-gracefully branch from 0a981b9 to 8f7aac5 Compare April 9, 2024 06:26
@l-qing
Copy link
Contributor Author

l-qing commented Apr 9, 2024

/retest-required

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/pod/creds_init.go 93.9% 94.9% 1.0

@l-qing
Copy link
Contributor Author

l-qing commented Apr 9, 2024

/retest-required

@l-qing
Copy link
Contributor Author

l-qing commented Apr 10, 2024

/test pull-tekton-pipeline-go-coverage-df

@tekton-robot
Copy link
Collaborator

@l-qing: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

  • /test pull-tekton-pipeline-alpha-integration-tests
  • /test pull-tekton-pipeline-beta-integration-tests
  • /test pull-tekton-pipeline-build-tests
  • /test pull-tekton-pipeline-integration-tests
  • /test pull-tekton-pipeline-unit-tests

The following commands are available to trigger optional jobs:

  • /test pull-tekton-pipeline-go-coverage

Use /test all to run all jobs.

In response to this:

/test pull-tekton-pipeline-go-coverage-df

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/pod/creds_init.go 93.9% 94.9% 1.0

@l-qing l-qing force-pushed the fix/handle-missing-secret-gracefully branch from b6c299b to fb1aba0 Compare April 13, 2024 07:36
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/pod/creds_init.go 93.9% 94.9% 1.0

@l-qing
Copy link
Contributor Author

l-qing commented Apr 13, 2024

/test pull-tekton-pipeline-go-coverage-df

@tekton-robot
Copy link
Collaborator

@l-qing: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

  • /test pull-tekton-pipeline-alpha-integration-tests
  • /test pull-tekton-pipeline-beta-integration-tests
  • /test pull-tekton-pipeline-build-tests
  • /test pull-tekton-pipeline-integration-tests
  • /test pull-tekton-pipeline-unit-tests

The following commands are available to trigger optional jobs:

  • /test pull-tekton-pipeline-go-coverage

Use /test all to run all jobs.

In response to this:

/test pull-tekton-pipeline-go-coverage-df

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/pod/creds_init.go 93.9% 94.9% 1.0

@l-qing l-qing force-pushed the fix/handle-missing-secret-gracefully branch from fb1aba0 to da67b6e Compare April 23, 2024 15:06
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/pod/creds_init.go 93.9% 94.9% 1.0

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/pod/creds_init.go 93.9% 94.9% 1.0

@l-qing
Copy link
Contributor Author

l-qing commented Apr 23, 2024

/retest-required

@l-qing
fix(taskrun): emit warning for missing secret in ServiceAccount inste…
51b48d8 
…ad of failing

fix tektoncd#7760

Log a warning if a Secrets in service account does not exist
@l-qing l-qing force-pushed the fix/handle-missing-secret-gracefully branch from da67b6e to 51b48d8 Compare April 24, 2024 15:28
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/pod/creds_init.go 93.9% 94.9% 1.0

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/pod/creds_init.go 93.9% 94.9% 1.0

@l-qing
Copy link
Contributor Author

l-qing commented Apr 25, 2024

/test pull-tekton-pipeline-integration-tests

@l-qing
Copy link
Contributor Author

l-qing commented Apr 25, 2024

/test pull-tekton-pipeline-go-coverage-df

@tekton-robot
Copy link
Collaborator

@l-qing: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

  • /test pull-tekton-pipeline-alpha-integration-tests
  • /test pull-tekton-pipeline-beta-integration-tests
  • /test pull-tekton-pipeline-build-tests
  • /test pull-tekton-pipeline-integration-tests
  • /test pull-tekton-pipeline-unit-tests

The following commands are available to trigger optional jobs:

  • /test pull-tekton-pipeline-go-coverage

Use /test all to run all jobs.

In response to this:

/test pull-tekton-pipeline-go-coverage-df

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/pod/creds_init.go 93.9% 94.9% 1.0

afrittoli
afrittoli reviewed Apr 25, 2024
View reviewed changes
Copy link
Member

@afrittoli afrittoli left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

pkg/pod/creds_init.go
@@ -51,7 +56,8 @@ var dnsLabel1123Forbidden = regexp.MustCompile("[^a-zA-Z0-9-]+")
// Any errors encountered during this process are returned to the
// caller. If no matching annotated secrets are found, nil lists with a
// nil error are returned.
func credsInit(ctx context.Context, serviceAccountName, namespace string, kubeclient kubernetes.Interface) ([]string, []corev1.Volume, []corev1.VolumeMount, error) {
func credsInit(ctx context.Context, obj runtime.Object, serviceAccountName, namespace string, kubeclient kubernetes.Interface) ([]string, []corev1.Volume, []corev1.VolumeMount, error) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The serviceAccountName could not be obtained from the runtime.Object by casting it to a task, but this approach keeps the code simpler the che change smaller, so I'm fine with it.

@tekton-robot
Copy link
Collaborator

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: afrittoli

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 25, 2024
@afrittoli afrittoli added this to the Pipelines v0.59 milestone Apr 25, 2024
@chitrangpatel
Copy link
Contributor

/lgtm

@tekton-robot tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Apr 25, 2024
@tekton-robot tekton-robot merged commit a494d6a into tektoncd:main Apr 25, 2024
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@afrittoli afrittoli afrittoli left review comments

@khrm khrm khrm left review comments

@jerop jerop Awaiting requested review from jerop

@pritidesai pritidesai Awaiting requested review from pritidesai

@abayer abayer Awaiting requested review from abayer

@dibyom dibyom Awaiting requested review from dibyom

@bobcatfish bobcatfish Awaiting requested review from bobcatfish

Assignees

@chitrangpatel chitrangpatel

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. kind/bug Categorizes issue or PR as related to a bug. lgtm Indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
Pipelines v0.59
Development

Successfully merging this pull request may close these issues.

TaskRun Fails to Create Pod When ServiceAccount References Non-Existent Secret
5 participants
@l-qing @tekton-robot @chitrangpatel @khrm @afrittoli