Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cleanup: breakup the pkg/credentials into writer and matcher #8542

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

waveywaves
Copy link
Member

@waveywaves waveywaves commented Jan 30, 2025

Changes

The credentials package contains the a matcher and a writer which out of which only the writer is used in cmd/entrypoint. In an effort to isolate usage and not indirectly import the corev1 api which the matcher uses for MatchingAnnotations, we are breaking up the credentials builder interface into two builders for writer and matcher.

This ensures that the entrypoint only uses the writer and not the matcher, and we are only using either the writer or the matcher functionality as necessary and not importing unnecessary deps.

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

  • Has Docs if any changes are user facing, including updates to minimum requirements e.g. Kubernetes version bumps
  • Has Tests included if any functionality added or changed
  • pre-commit Passed
  • Follows the commit message standard
  • Meets the Tekton contributor standards (including functionality, content, code)
  • Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
  • Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings). See some examples of good release notes.
  • Release notes contains the string "action required" if the change requires additional action from users switching to the new release

/kind cleanup

Release Notes

import only the writer part of the credentials package in the entrypoint so that we do not pull core v1 API indirectly into the package

@tekton-robot
Copy link
Collaborator

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@tekton-robot tekton-robot added kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jan 30, 2025
@tekton-robot tekton-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Jan 30, 2025
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/gitcreds/creds.go 94.7% 94.4% -0.3
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 100.0%
pkg/credentials/matcher/matcher.go Do not exist 100.0%
pkg/credentials/matcher/matcher.go Do not exist 20.0%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

Copy link
Member

@vdemeester vdemeester left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good start ❤️ Needs a bit more work but it's definitely going into the right direction.

@@ -33,9 +33,9 @@ import (
featureFlags "github.com/tektoncd/pipeline/pkg/apis/config"
"github.com/tektoncd/pipeline/pkg/apis/pipeline"
v1 "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1"
"github.com/tektoncd/pipeline/pkg/credentials"
"github.com/tektoncd/pipeline/pkg/credentials/dockercreds"
"github.com/tektoncd/pipeline/pkg/credentials/gitcreds"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We will need to do the same for credentials/{dockercreds,gitcreds… 👼🏼

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure what you mean 🤔 😅

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we need to find a way to not use these imports
"github.com/tektoncd/pipeline/pkg/credentials/dockercreds"
"github.com/tektoncd/pipeline/pkg/credentials/gitcreds"

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not necessarily not use them, but finding a way so they do not bring corev1 with it.

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/gitcreds/creds.go 94.7% 94.4% -0.3
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 100.0%
pkg/credentials/matcher/matcher.go Do not exist 50.0%
pkg/credentials/matcher/matcher.go Do not exist 20.0%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@waveywaves waveywaves marked this pull request as ready for review February 3, 2025 11:23
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/gitcreds/creds.go 94.7% 94.4% -0.3
pkg/credentials/matcher/matcher.go Do not exist 100.0%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 100.0%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 50.0%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@vdemeester
Copy link
Member

/retest

1 similar comment
@vdemeester
Copy link
Member

/retest

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/gitcreds/creds.go 94.7% 94.4% -0.3
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 100.0%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 20.0%
pkg/credentials/matcher/matcher.go Do not exist 100.0%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@waveywaves waveywaves force-pushed the cleanup/entrypoint-credentials-fips branch 3 times, most recently from 0e86d08 to ecfd3a3 Compare February 12, 2025 18:25
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/gitcreds/basic.go 89.3% 88.2% -1.1
pkg/credentials/gitcreds/creds.go 94.7% 94.4% -0.3
pkg/credentials/gitcreds/ssh.go 88.5% 87.1% -1.4
pkg/credentials/matcher/matcher.go Do not exist 43.8%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 87.5%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 43.8%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@waveywaves
Copy link
Member Author

waveywaves commented Feb 12, 2025

@vdemeester @jkhelil PTAL 🙏

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/gitcreds/creds.go 94.7% 94.4% -0.3
pkg/credentials/matcher/matcher.go Do not exist 87.5%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 87.5%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 43.8%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/gitcreds/creds.go 94.7% 94.4% -0.3
pkg/credentials/gitcreds/ssh.go 88.5% 87.1% -1.4
pkg/credentials/matcher/matcher.go Do not exist 43.8%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 87.5%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 43.8%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/matcher/matcher.go Do not exist 87.5%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 43.8%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/matcher/matcher.go Do not exist 43.8%
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@waveywaves waveywaves force-pushed the cleanup/entrypoint-credentials-fips branch from ecfd3a3 to 03eec53 Compare February 19, 2025 12:08
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@waveywaves waveywaves force-pushed the cleanup/entrypoint-credentials-fips branch from 5bda94b to 8a76dbd Compare February 19, 2025 19:31
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@waveywaves
Copy link
Member Author

@vdemeester @jkhelil PTAL 🙏

@waveywaves waveywaves force-pushed the cleanup/entrypoint-credentials-fips branch from 8a76dbd to 4ccc489 Compare February 19, 2025 20:29
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@tekton-robot tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 26, 2025
@vdemeester vdemeester removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 26, 2025
@jkhelil
Copy link
Member

jkhelil commented Feb 26, 2025

/approve

@tekton-robot tekton-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 3, 2025
The credentials package contains the a matcher and a writer which out of
which only the writer is used in cmd/entrypoint. In an effort to isolate
usage and not indirectly import the corev1 api which the matcher uses
for MatchingAnnotations, we are breaking up the credentials builder interface
into two builders for writer and matcher.

This ensures that the entrypoint only uses the writer and not the matcher,
and we are only using either the writer or the matcher functionality
as necessary and not importing unnecessary deps.

cleanup: use better names for the credentials interfaces

cleanup: use CredsDir from entrypoint pkg instead of pipeline

cleanup: remove corev1 usage from credentials package

cleanup: add goling gosec exception for Secret type constants
@waveywaves waveywaves force-pushed the cleanup/entrypoint-credentials-fips branch from 4ccc489 to b9d05a7 Compare March 4, 2025 00:25
@tekton-robot tekton-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 4, 2025
@tekton-robot
Copy link
Collaborator

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File Old Coverage New Coverage Delta
pkg/credentials/matcher/matcher.go Do not exist 0.0%
pkg/credentials/writer/writer.go Do not exist 46.0%

@vdemeester
Copy link
Member

/retest

@vdemeester
Copy link
Member

cc @afrittoli @chitrangpatel

@jkhelil
Copy link
Member

jkhelil commented Mar 6, 2025

/approve

@tekton-robot
Copy link
Collaborator

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jkhelil, vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
Status: Todo
Development

Successfully merging this pull request may close these issues.

4 participants