Securing OpenShift Pipelines
Securing OpenShift Pipelines Red Hat OpenShift Pipelines 1.18 Security features of OpenShift Pipelines Red Hat OpenShift Documentation Team
oc edit TektonConfig config apiVersion: operator.tekton.dev/v1alpha1 kind: TektonConfig metadata: name: config spec: addon: {} chain: artifacts.taskrun.format: tekton config: {} chains.tekton.dev/transparency-upload: "true" oc create secret generic mongo-url -n tekton-chains --from-file=MONGO_SERVER_URL=<path>/MONGO_SERVER_URL 1 apiVersion: operator.tekton.dev/v1 kind: TektonConfig metadata: name: config spec: chain: disabled: false storage.docdb.mongo-server-url-dir: /tmp/mongo-url options: deployments: tekton-chains-controller: spec: template: spec: containers: - name: tekton-chains-controller volumeMounts: - mountPath: /tmp/mongo-url name: mongo-url volumes: - name: mongo-url secret: secretName: mongo-url oc create secret generic kms-secrets -n tekton-chains --from-file=KMS_AUTH_TOKEN=<path_and_name> 1 apiVersion: operator.tekton.dev/v1 kind: TektonConfig metadata: name: config spec: chain: disabled: false signers.kms.auth.token-path: /etc/kms-secrets/KMS_AUTH_TOKEN options: deployments: tekton-chains-controller: spec: template: spec: containers: - name: tekton-chains-controller volumeMounts: - mountPath: /etc/kms-secrets name: kms-secrets volumes: - name: kms-secrets secret: secretName: kms-secrets apiVersion: operator.tekton.dev/v1alpha1 kind: TektonConfig metadata: name: config spec: chain: disabled: false options: deployments: tekton-chains-controller: spec: template: spec: containers: - args: - --namespace=dev, test 1 name: tekton-chains-controller oc edit TektonConfig config apiVersion: operator.tekton.dev/v1 kind: TektonConfig metadata: name: config spec: chain: disabled: false generateSigningSecret: true 1 cosign generate-key-pair k8s://openshift-pipelines/signing-secrets skopeo generate-sigstore-key --output-prefix <mykey> 1 base64 -w 0 <mykey>.pub > b64.pub base64 -w 0 <mykey>.private > b64.private echo -n '<passphrase>' | base64 -w 0 > b64.passphrase 1 oc create secret generic signing-secrets -n openshift-pipelines oc edit secret -n openshift-pipelines signing-secrets apiVersion: v1 data: cosign.key: <Encoded <mykey>.private> 1 cosign.password: <Encoded passphrase> 2 cosign.pub: <Encoded <mykey>.pub> 3 immutable: true kind: Secret metadata: name: signing-secrets type: Opaque Error from server (AlreadyExists): secrets "signing-secrets" already exists oc delete secret signing-secrets -n openshift-pipelines export NAMESPACE=<namespace> 1 export SERVICE_ACCOUNT_NAME=<service_account> 2 oc create secret registry-credentials --from-file=.dockerconfigjson \ 1 --type=kubernetes.io/dockerconfigjson -n USDNAMESPACE oc patch serviceaccount USDSERVICE_ACCOUNT_NAME -p "{\"imagePullSecrets\": [{\"name\": \"registry-credentials\"}]}" -n USDNAMESPACE oc create serviceaccount <service_account_name> apiVersion: tekton.dev/v1 kind: TaskRun metadata: name: build-push-task-run-2 spec: taskRunTemplate: serviceAccountName: build-bot 1 taskRef: name: build-push apiVersion: operator.tekton.dev/v1alpha1 kind: TektonConfig metadata: name: config spec: chain: artifacts.oci.storage: "" artifacts.taskrun.format: tekton artifacts.taskrun.storage: tekton oc delete po -n openshift-pipelines -l app=tekton-chains-controller oc create -f https://raw.githubusercontent.com/tektoncd/chains/main/examples/taskruns/task-output-image.yaml 1 taskrun.tekton.dev/build-push-run-output-image-qbjvh created tkn tr describe --last [...truncated output...] NAME STATUS ∙ create-dir-builtimage-9467f Completed ∙ git-source-sourcerepo-p2sk8 Completed ∙ build-and-push Completed ∙ echo Completed ∙ image-digest-exporter-xlkn7 Completed tkn tr describe --last -o jsonpath="{.metadata.annotations.chains\.tekton\.dev/signature-taskrun-USDTASKRUN_UID}" | base64 -d > sig export TASKRUN_UID=USD(tkn tr describe --last -o jsonpath='{.metadata.uid}') cosign verify-blob-attestation --insecure-ignore-tlog --key path/to/cosign.pub --signature sig --type slsaprovenance --check-claims=false /dev/null 1 Verified OK oc create secret generic <docker_config_secret_name> \ 1 --from-file <path_to_config.json> 2 oc patch configmap chains-config -n openshift-pipelines -p='{"data":{"artifacts.taskrun.format": "in-toto"}}' oc patch configmap chains-config -n openshift-pipelines -p='{"data":{"artifacts.taskrun.storage": "oci"}}' oc patch configmap chains-config -n openshift-pipelines -p='{"data":{"transparency.enabled": "true"}}' oc apply -f examples/kaniko/kaniko.yaml 1 export REGISTRY=<url_of_registry> 1 export DOCKERCONFIG_SECRET_NAME=<name_of_the_secret_in_docker_config_json> 2 tkn task start --param IMAGE=USDREGISTRY/kaniko-chains --use-param-defaults --workspace name=source,emptyDir="" --workspace name=dockerconfig,secret=USDDOCKERCONFIG_SECRET_NAME kaniko-chains oc get tr <task_run_name> \ 1 -o json | jq -r .metadata.annotations { "chains.tekton.dev/signed": "true", } cosign verify --key cosign.pub USDREGISTRY/kaniko-chains cosign verify-attestation --key cosign.pub USDREGISTRY/kaniko-chains rekor-cli search --sha <image_digest> 1 <uuid_1> 2 <uuid_2> 3 rekor-cli get --uuid <uuid> --format json | jq -r .Attestation | base64 --decode | jq The format to extract vulnerability summary (adjust the jq command for different JSON structures). jq -rce '{vulnerabilities:{ critical: (.result.summary.CRITICAL), high: (.result.summary.IMPORTANT), medium: (.result.summary.MODERATE), low: (.result.summary.LOW) }}' scan_output.json | tee USD(results.SCAN_OUTPUT.path) apiVersion: tekton.dev/v1 kind: Task metadata: name: vulnerability-scan 1 annotations: task.output.location: results 2 task.results.format: application/json task.results.key: SCAN_OUTPUT 3 spec: params: - description: Image to be scanned name: image type: string results: - description: CVE result format 4 name: SCAN_OUTPUT steps: - name: roxctl image: 'quay.io/lrangine/crda-maven:11.0' 5 env: - name: ROX_CENTRAL_ENDPOINT valueFrom: secretKeyRef: key: rox_central_endpoint 6 name: roxsecrets - name: ROX_API_TOKEN valueFrom: secretKeyRef: key: rox_api_token 7 name: roxsecrets name: roxctl-scan script: | 8 #!/bin/sh curl -k -L -H "Authorization: Bearer USDROX_API_TOKEN" https://USDROX_CENTRAL_ENDPOINT/api/cli/download/roxctl-linux --output ./roxctl chmod +x ./roxctl ./roxctl image scan --insecure-skip-tls-verify -e USDROX_CENTRAL_ENDPOINT --image USD(params.image) --output json > roxctl_output.json jq -rce "{vulnerabilities:{ critical: (.result.summary.CRITICAL), high: (.result.summary.IMPORTANT), medium: (.result.summary.MODERATE), low: (.result.summary.LOW) }}" roxctl_output.json | tee USD(results.SCAN_OUTPUT.path) spec: results: - description: The common vulnerabilities and exposures (CVE) result name: SCAN_OUTPUT value: USD(tasks.vulnerability-scan.results.SCAN_OUTPUT) apiVersion: tekton.dev/v1 kind: Task metadata: name: sbom-task 1 annotations: task.output.location: results 2 task.results.format: application/text task.results.key: LINK_TO_SBOM 3 task.results.type: external-link 4 spec: results: - description: Contains the SBOM link 5 name: LINK_TO_SBOM steps: - name: print-sbom-results image: quay.io/image 6 script: | 7 #!/bin/sh syft version syft quay.io/<username>/quarkus-demo:v2 --output cyclonedx-json=sbom-image.json echo 'BEGIN SBOM' cat sbom-image.json echo 'END SBOM' echo 'quay.io/user/workloads/<namespace>/node-express/node-express:build-8e536-1692702836' | tee USD(results.LINK_TO_SBOM.path) 8 spec: tasks: - name: sbom-task taskRef: name: sbom-task 1 results: - name: IMAGE_URL 2 description: url value: <oci_image_registry_url> 3 cosign download sbom quay.io/<workspace>/user-workload@sha256 cosign download sbom quay.io/<workspace>/user-workload@sha256 > sbom.txt { "bomFormat": "CycloneDX", "specVersion": "1.4", "serialNumber": "urn:uuid:89146fc4-342f-496b-9cc9-07a6a1554220", "version": 1, "metadata": { }, "components": [ { "bom-ref": "pkg:pypi/flask@2.1.0?package-id=d6ad7ed5aac04a8", "type": "library", "author": "Armin Ronacher <armin.ronacher@active-4.com>", "name": "Flask", "version": "2.1.0", "licenses": [ { "license": { "id": "BSD-3-Clause" } } ], "cpe": "cpe:2.3:a:armin-ronacher:python-Flask:2.1.0:*:*:*:*:*:*:*", "purl": "pkg:pypi/Flask@2.1.0", "properties": [ { "name": "syft:package:foundBy", "value": "python-package-cataloger" apiVersion: security.openshift.io/v1 kind: SecurityContextConstraints allowedCapabilities: - SETFCAP fsGroup: type: MustRunAs oc edit TektonConfig config apiVersion: operator.tekton.dev/v1alpha1 kind: TektonConfig metadata: name: config spec: platforms: openshift: scc: default: "restricted-v2" 1 maxAllowed: "privileged" 2 apiVersion: v1 kind: Namespace metadata: name: test-namespace annotations: operator.tekton.dev/scc: nonroot apiVersion: security.openshift.io/v1 kind: SecurityContextConstraints metadata: annotations: kubernetes.io/description: my-scc is a close replica of anyuid scc. pipelines-scc has fsGroup - RunAsAny. name: my-scc allowHostDirVolumePlugin: false allowHostIPC: false allowHostNetwork: false allowHostPID: false allowHostPorts: false allowPrivilegeEscalation: true allowPrivilegedContainer: false allowedCapabilities: null defaultAddCapabilities: null fsGroup: type: RunAsAny groups: - system:cluster-admins priority: 10 readOnlyRootFilesystem: false requiredDropCapabilities: - MKNOD runAsUser: type: RunAsAny seLinuxContext: type: MustRunAs supplementalGroups: type: RunAsAny volumes: - configMap - downwardAPI - emptyDir - persistentVolumeClaim - projected - secret oc create -f my-scc.yaml oc create serviceaccount fsgroup-runasany oc adm policy add-scc-to-user my-scc -z fsgroup-runasany oc adm policy add-scc-to-user privileged -z fsgroup-runasany apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: <pipeline-run-name> spec: pipelineRef: name: <pipeline-cluster-task-name> taskRunTemplate: serviceAccountName: 'fsgroup-runasany' apiVersion: tekton.dev/v1 kind: TaskRun metadata: name: <task-run-name> spec: taskRef: name: <cluster-task-name> taskRunTemplate: serviceAccountName: 'fsgroup-runasany' service.beta.openshift.io/serving-cert-secret-name=<secret_name> oc create route reencrypt --service=<svc-name> --cert=tls.crt --key=tls.key --ca-cert=ca.crt --hostname=<hostname> apiVersion: route.openshift.io/v1 kind: Route metadata: name: route-passthrough-secured 1 spec: host: <hostname> to: kind: Service name: frontend 2 tls: termination: reencrypt 3 key: [as in edge termination] certificate: [as in edge termination] caCertificate: [as in edge termination] destinationCACertificate: |- 4 -----BEGIN CERTIFICATE----- [...] -----END CERTIFICATE----- oc create -f https://raw.githubusercontent.com/openshift/pipelines-tutorial/master/03_triggers/01_binding.yaml oc create -f https://raw.githubusercontent.com/openshift/pipelines-tutorial/master/03_triggers/02_template.yaml oc create -f https://raw.githubusercontent.com/openshift/pipelines-tutorial/master/03_triggers/03_trigger.yaml oc label namespace <ns-name> operator.tekton.dev/enable-annotation=enabled oc create -f https://raw.githubusercontent.com/openshift/pipelines-tutorial/master/03_triggers/04_event_listener.yaml oc create route reencrypt --service=<svc-name> --cert=tls.crt --key=tls.key --ca-cert=ca.crt --hostname=<hostname> apiVersion: v1 kind: Secret metadata: name: git-secret-basic annotations: tekton.dev/git-0: github.com tekton.dev/git-1: gitlab.com type: kubernetes.io/basic-auth stringData: username: <username> 1 password: <password> 2 apiVersion: v1 kind: Secret metadata: name: git-secret-ssh annotations: tekton.dev/git-0: https://github.com type: kubernetes.io/ssh-auth stringData: ssh-privatekey: 1 apiVersion: v1 kind: Secret metadata: name: docker-secret-basic annotations: tekton.dev/docker-0: quay.io tekton.dev/docker-1: my-registry.example.com type: kubernetes.io/basic-auth stringData: username: <username> 1 password: <password> 2 oc create secret generic docker-secret-config --from-file=config.json=/home/user/.docker/config.json --type=kubernetes.io/dockerconfigjson oc create secret docker-registry docker-secret-config --docker-email=<email> \ 1 --docker-username=<username> \ 2 --docker-password=<password> \ 3 --docker-server=my-registry.example.com:5000 4 apiVersion: v1 kind: Secret metadata: name: basic-user-pass 1 annotations: tekton.dev/git-0: https://github.com type: kubernetes.io/basic-auth stringData: username: <username> 2 password: <password> 3 apiVersion: v1 kind: ServiceAccount metadata: name: build-bot 1 secrets: - name: basic-user-pass 2 apiVersion: tekton.dev/v1 kind: TaskRun metadata: name: build-push-task-run-2 1 spec: taskRunTemplate: serviceAccountName: build-bot 2 taskRef: name: build-push 3 apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: demo-pipeline 1 namespace: default spec: taskRunTemplate: serviceAccountName: build-bot 2 pipelineRef: name: demo-pipeline 3 oc apply --filename secret.yaml,serviceaccount.yaml,run.yaml apiVersion: v1 kind: Secret metadata: name: ssh-key 1 annotations: tekton.dev/git-0: github.com type: kubernetes.io/ssh-auth stringData: ssh-privatekey: 2 known_hosts: 3 apiVersion: v1 kind: ServiceAccount metadata: name: build-bot 1 secrets: - name: ssh-key 2 apiVersion: tekton.dev/v1 kind: TaskRun metadata: name: build-push-task-run-2 1 spec: taskRunTemplate: serviceAccountName: build-bot 2 taskRef: name: build-push 3 apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: demo-pipeline 1 namespace: default spec: taskRunTemplate: serviceAccountName: build-bot 2 pipelineRef: name: demo-pipeline 3 oc apply --filename secret.yaml,serviceaccount.yaml,run.yaml oc create secret generic my-registry-credentials \ 1 --from-file=config.json=/home/user/credentials/config.json 2 apiVersion: v1 kind: ServiceAccount metadata: name: container-bot 1 secrets: - name: my-registry-credentials 2 apiVersion: tekton.dev/v1 kind: TaskRun metadata: name: build-container-task-run-2 1 spec: taskRunTemplate: serviceAccountName: container-bot 2 taskRef: name: build-container 3 apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: demo-pipeline 1 namespace: default spec: taskRunTemplate: serviceAccountName: container-bot 2 pipelineRef: name: demo-pipeline 3 oc apply --filename serviceaccount.yaml,run.yaml apiVersion: tekton.dev/v1 kind: Task metadata: name: example-git-task spec: steps: - name: example-git-step script: ln -s USDHOME/.ssh /root/.ssh oc create secret generic my-github-ssh-credentials \ 1 --from-file=id_ed25519=/home/user/.ssh/id_ed25519 \ 2 --from-file=known_hosts=/home/user/.ssh/known_hosts 3 apiVersion: tekton.dev/v1beta1 kind: Task metadata: name: git-clone spec: workspaces: - name: ssh-directory description: | A .ssh directory with private key, known_hosts, config, etc. tkn task start <task_name> --workspace name=<workspace_name>,secret=<secret_name> 1 # apiVersion: tekton.dev/v1beta1 kind: Task metadata: name: git-clone spec: workspaces: - name: output description: The git repo will be cloned onto the volume backing this Workspace. - name: ssh-directory description: | A .ssh directory with private key, known_hosts, config, etc. Copied to the user's home before git commands are executed. Used to authenticate with the git remote when performing the clone. Binding a Secret to this Workspace is strongly recommended over other volume types params: - name: url description: Repository URL to clone from. type: string - name: revision description: Revision to checkout. (branch, tag, sha, ref, etc...) type: string default: "" - name: gitInitImage description: The image providing the git-init binary that this Task runs. type: string default: "gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init:v0.37.0" results: - name: commit description: The precise commit SHA that was fetched by this Task. - name: url description: The precise URL that was fetched by this Task. steps: - name: clone image: "USD(params.gitInitImage)" script: | #!/usr/bin/env sh set -eu # This is necessary for recent version of git git config --global --add safe.directory '*' cp -R "USD(workspaces.ssh-directory.path)" "USD{HOME}"/.ssh 1 chmod 700 "USD{HOME}"/.ssh chmod -R 400 "USD{HOME}"/.ssh/* CHECKOUT_DIR="USD(workspaces.output.path)/" /ko-app/git-init -url="USD(params.url)" -revision="USD(params.revision)" -path="USD{CHECKOUT_DIR}" cd "USD{CHECKOUT_DIR}" RESULT_SHA="USD(git rev-parse HEAD)" EXIT_CODE="USD?" if [ "USD{EXIT_CODE}" != 0 ] ; then exit "USD{EXIT_CODE}" fi printf "%s" "USD{RESULT_SHA}" > "USD(results.commit.path)" printf "%s" "USD(params.url)" > "USD(results.url.path)" tkn task start git-clone --param url=git@github.com:example-github-user/buildkit-tekton --workspace name=output,emptyDir="" --workspace name=ssh-directory,secret=my-github-ssh-credentials --use-param-defaults --showlog oc create secret generic my-registry-credentials \ 1 --from-file=config.json=/home/user/credentials/config.json 2 apiVersion: tekton.dev/v1beta1 kind: Task metadata: name: skopeo-copy spec: workspaces: - name: dockerconfig description: Includes a docker `config.json` tkn task start <task_name> --workspace name=<workspace_name>,secret=<secret_name> 1 # apiVersion: tekton.dev/v1beta1 kind: Task metadata: name: skopeo-copy spec: workspaces: - name: dockerconfig 1 description: Includes a docker `config.json` steps: - name: clone image: quay.io/skopeo/stable:v1.8.0 env: - name: DOCKER_CONFIG value: USD(workspaces.dockerconfig.path) 2 script: | #!/usr/bin/env sh set -eu skopeo copy docker://docker.io/library/ubuntu:latest docker://quay.io/example_repository/ubuntu-copy:latest tkn task start skopeo-copy --workspace name=dockerconfig,secret=my-registry-credentials --use-param-defaults --showlog apiVersion: tekton.dev/v1beta1 kind: Task metadata: name: git-clone-build spec: workspaces: 1 - name: ssh-directory description: | A .ssh directory with private key, known_hosts, config, etc. steps: - name: clone workspaces: 2 - name: ssh-directory - name: build 3 oc get task buildah -n openshift-pipelines -o yaml | yq '. |= (del .metadata |= with_entries(select(.key == "name" )))' | yq '.kind="Task"' | yq '.metadata.name="buildah-as-user"' | oc create -f - oc edit task buildah-as-user apiVersion: tekton.dev/v1 kind: Task metadata: annotations: io.kubernetes.cri-o.userns-mode: 'auto:size=65536;map-to-root=true' io.openshift.builder: 'true' name: assemble-containerimage namespace: pipeline-namespace spec: description: This task builds an image. stepTemplate: env: - name: HOME value: /tekton/home image: USD(params.builder-image) imagePullPolicy: IfNotPresent name: '' resources: limits: cpu: '1' memory: 4Gi requests: cpu: 100m memory: 2Gi securityContext: capabilities: add: - SETFCAP runAsNonRoot: true runAsUser: 1000 1 workingDir: USD(workspaces.working-directory.path) apiVersion: v1 kind: ServiceAccount metadata: name: pipelines-sa-userid-1000 1 --- kind: SecurityContextConstraints metadata: annotations: name: pipelines-scc-userid-1000 2 allowHostDirVolumePlugin: false allowHostIPC: false allowHostNetwork: false allowHostPID: false allowHostPorts: false allowPrivilegeEscalation: true 3 allowPrivilegedContainer: false allowedCapabilities: null apiVersion: security.openshift.io/v1 defaultAddCapabilities: null fsGroup: type: MustRunAs groups: - system:cluster-admins priority: 10 readOnlyRootFilesystem: false requiredDropCapabilities: - MKNOD - KILL runAsUser: 4 type: MustRunAs uid: 1000 seLinuxContext: type: MustRunAs supplementalGroups: type: RunAsAny users: [] volumes: - configMap - downwardAPI - emptyDir - persistentVolumeClaim - projected - secret --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: pipelines-scc-userid-1000-clusterrole 5 rules: - apiGroups: - security.openshift.io resourceNames: - pipelines-scc-userid-1000 resources: - securitycontextconstraints verbs: - use --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: pipelines-scc-userid-1000-rolebinding 6 roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: pipelines-scc-userid-1000-clusterrole subjects: - kind: ServiceAccount name: pipelines-sa-userid-1000 oc get task buildah -n openshift-pipelines -o yaml | yq '. |= (del .metadata |= with_entries(select(.key == "name" )))' | yq '.kind="Task"' | yq '.metadata.name="buildah-as-user"' | oc create -f - oc edit task buildah-as-user apiVersion: tekton.dev/v1 kind: Task metadata: name: buildah-as-user spec: description: >- Buildah task builds source into a container image and then pushes it to a container registry. Buildah Task builds source into a container image using Project Atomic's Buildah build tool.It uses Buildah's support for building from Dockerfiles, using its buildah bud command.This command executes the directives in the Dockerfile to assemble a container image, then pushes that image to a container registry. params: - name: IMAGE description: Reference of the image buildah will produce. - name: BUILDER_IMAGE description: The location of the buildah builder image. default: registry.redhat.io/rhel8/buildah@sha256:99cae35f40c7ec050fed3765b2b27e0b8bbea2aa2da7c16408e2ca13c60ff8ee - name: STORAGE_DRIVER description: Set buildah storage driver default: vfs - name: DOCKERFILE description: Path to the Dockerfile to build. default: ./Dockerfile - name: CONTEXT description: Path to the directory to use as context. default: . - name: TLSVERIFY description: Verify the TLS on the registry endpoint (for push/pull to a non-TLS registry) default: "true" - name: FORMAT description: The format of the built container, oci or docker default: "oci" - name: BUILD_EXTRA_ARGS description: Extra parameters passed for the build command when building images. default: "" - description: Extra parameters passed for the push command when pushing images. name: PUSH_EXTRA_ARGS type: string default: "" - description: Skip pushing the built image name: SKIP_PUSH type: string default: "false" results: - description: Digest of the image just built. name: IMAGE_DIGEST type: string workspaces: - name: source steps: - name: build securityContext: runAsUser: 1000 1 image: USD(params.BUILDER_IMAGE) workingDir: USD(workspaces.source.path) script: | echo "Running as USER ID `id`" 2 buildah --storage-driver=USD(params.STORAGE_DRIVER) bud USD(params.BUILD_EXTRA_ARGS) --format=USD(params.FORMAT) --tls-verify=USD(params.TLSVERIFY) --no-cache -f USD(params.DOCKERFILE) -t USD(params.IMAGE) USD(params.CONTEXT) [[ "USD(params.SKIP_PUSH)" == "true" ]] && echo "Push skipped" && exit 0 buildah --storage-driver=USD(params.STORAGE_DRIVER) push USD(params.PUSH_EXTRA_ARGS) --tls-verify=USD(params.TLSVERIFY) --digestfile USD(workspaces.source.path)/image-digest USD(params.IMAGE) docker://USD(params.IMAGE) cat USD(workspaces.source.path)/image-digest | tee /tekton/results/IMAGE_DIGEST volumeMounts: - name: varlibcontainers mountPath: /home/build/.local/share/containers 3 volumes: - name: varlibcontainers emptyDir: {} apiVersion: v1 data: Dockerfile: | ARG BASE_IMG=registry.access.redhat.com/ubi9/ubi FROM USDBASE_IMG AS buildah-runner RUN dnf -y update && dnf -y install git && dnf clean all CMD git kind: ConfigMap metadata: name: dockerfile 1 --- apiVersion: tekton.dev/v1 kind: TaskRun metadata: name: buildah-as-user-1000 spec: taskRunTemplate: serviceAccountName: pipelines-sa-userid-1000 2 params: - name: IMAGE value: image-registry.openshift-image-registry.svc:5000/test/buildahuser taskRef: kind: Task name: buildah-as-user workspaces: - configMap: name: dockerfile 3 name: source apiVersion: tekton.dev/v1 kind: Pipeline metadata: name: pipeline-buildah-as-user-1000 spec: params: - name: IMAGE - name: URL workspaces: - name: shared-workspace - name: sslcertdir optional: true tasks: - name: fetch-repository 1 taskRef: resolver: cluster params: - name: kind value: task - name: name value: git-clone - name: namespace value: openshift-pipelines workspaces: - name: output workspace: shared-workspace params: - name: URL value: USD(params.URL) - name: SUBDIRECTORY value: "" - name: DELETE_EXISTING value: "true" - name: buildah taskRef: name: buildah-as-user 2 runAfter: - fetch-repository workspaces: - name: source workspace: shared-workspace - name: sslcertdir workspace: sslcertdir params: - name: IMAGE value: USD(params.IMAGE) --- apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: pipelinerun-buildah-as-user-1000 spec: taskRunSpecs: - pipelineTaskName: buildah taskServiceAccountName: pipelines-sa-userid-1000 3 params: - name: URL value: https://github.com/openshift/pipelines-vote-api - name: IMAGE value: image-registry.openshift-image-registry.svc:5000/test/buildahuser pipelineRef: name: pipeline-buildah-as-user-1000 workspaces: - name: shared-workspace 4 volumeClaimTemplate: spec: accessModes: - ReadWriteOnce resources: requests: storage: 100Mi