Add PNC prebuild task based upon git-clone-oci-ta #1819
Conversation
| - prepare | ||
| - --build-tool-version=$(params.BUILD_TOOL_VERSION) | ||
| - --java-version=$(params.JAVA_VERSION) | ||
| - --recipe-image=$(params.RECIPE_IMAGE) | ||
| - --tooling-image=$(params.PNC_KONFLUX_TOOLING_IMAGE) | ||
| - --type=$(params.BUILD_TOOL) | ||
| - /var/workdir/source |
There was a problem hiding this comment.
This is a very opaque command. It isn'y clear what this actually does to the source especially since it is running with full access to the internet. I don't know how we would be able to qualify/verify our trust in the changes made here.
There was a problem hiding this comment.
Admittedly this command does not need network access and is similar to what we would need if KONFLUX-4903 was available. It runs java code to preprocess the source to ensure its possible to build it inside a container from https://github.com/project-ncl/konflux-tooling and is only meant to be used by middleware/pnc. Is one of the main concerns because the language is not in shell scripting?
There was a problem hiding this comment.
If the concern is full internet access we can probably run it within "unshare" but I believe it's a matter of trusting the application, that it rally does what it should?
There was a problem hiding this comment.
If it doesn't need internet access, I'd restrict it.
There was a problem hiding this comment.
@mmorhun Are you saying this is your only objection before approval? That tooling image does not currently have unshare installed so we would have to modify the image I suppose.
There was a problem hiding this comment.
I'll look at installing unshare in the tooling image and running this command with unshare -n /opt/jboss/container/java/run/run-java.sh...
There was a problem hiding this comment.
Unfortunately I get unshare: unshare failed: Operation not permitted when trying to run the above command
There was a problem hiding this comment.
Rather than unshare, would it be acceptable to simply define -DsocksProxyHost=does.not.exist which according to https://docs.oracle.com/javase/7/docs/technotes/guides/net/proxies.html should force all outgoing TCP connections to go via the proxy (which will then fail) ?
| - op: replace | ||
| path: /spec/description | ||
| value: The pnc-prebuild-git-clone-oci-ta Task will clone a repo from the provided url, apply | ||
| PNC prebuild modifications from https://github.com/project-ncl/konflux-tooling and store |
There was a problem hiding this comment.
konflux-tooling sounds too generic for me, maybe pnc-konflux-tooling would be better? At least for the image name
There was a problem hiding this comment.
I am not sure how we can change the image name as isn't it derived from the repository name?
There was a problem hiding this comment.
You can release it via Konflux
| - --build-tool-version=$(params.BUILD_TOOL_VERSION) | ||
| - --java-version=$(params.JAVA_VERSION) | ||
| - --recipe-image=$(params.RECIPE_IMAGE) | ||
| - --tooling-image=quay.io/redhat-user-workloads/konflux-jbs-pnc-tenant/konflux-tooling:latest |
There was a problem hiding this comment.
I don't think that we should reference an image from redhat-user-workloads as this can be accidentally deleted of the component is deleted. Can we release this to be an image in quay.io/konflux-ci instead?
There was a problem hiding this comment.
Agreed but we'll have to discuss that on how best to release that single component to the konflux owned namespace.
As middleware (PNC) need to preprocess the source in order to prepare it for building within a container an extra step is required for the PNC custom pipeline