Skip to content

Commit 87e123e

Browse files
savitaashturetekton-robot
savitaashture
authored and
tekton-robot
committed
Refactor to handle conversion at config level
1 parent 7797f41 commit 87e123e

File tree

7 files changed

+94
-77
lines changed

7 files changed

+94
-77
lines changed

‎pkg/apis/config/default.go

Lines changed: 29 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -30,18 +30,22 @@ const (
3030
defaultRunAsGroupKey = "default-run-as-group"
3131
defaultRunAsNonRootKey = "default-run-as-non-root"
3232
DefaultServiceAccountValue = "default"
33-
defaultRunAsUserValue = "65532"
34-
defaultRunAsGroupValue = "65532"
33+
defaultRunAsUserValue = 65532
34+
defaultRunAsGroupValue = 65532
3535
defaultRunAsNonRootValue = true
3636
)
3737

3838
// Defaults holds the default configurations
3939
// +k8s:deepcopy-gen=true
4040
type Defaults struct {
4141
DefaultServiceAccount string
42-
DefaultRunAsUser string
43-
DefaultRunAsGroup string
42+
DefaultRunAsUser int64
43+
DefaultRunAsGroup int64
4444
DefaultRunAsNonRoot bool
45+
// These two fields are used to decide whether to configure
46+
// runAsUser and runAsGroup within a Security Context Constraint (SCC).
47+
IsDefaultRunAsUserEmpty bool
48+
IsDefaultRunAsGroupEmpty bool
4549
}
4650

4751
// GetDefaultsConfigName returns the name of the configmap containing all
@@ -83,18 +87,36 @@ func NewDefaultsFromMap(cfgMap map[string]string) (*Defaults, error) {
8387
}
8488

8589
if defaultRunAsUser, ok := cfgMap[defaultRunAsUserKey]; ok {
86-
tc.DefaultRunAsUser = defaultRunAsUser
90+
if defaultRunAsUser != "" {
91+
runAsUser, err := strconv.ParseInt(defaultRunAsUser, 10, 0)
92+
if err != nil {
93+
return nil, fmt.Errorf("failed parsing runAsUser config %q", defaultRunAsUser)
94+
}
95+
tc.DefaultRunAsUser = runAsUser
96+
} else {
97+
// if runAsUser is "" don't set runAsUser in SCC
98+
tc.IsDefaultRunAsUserEmpty = true
99+
}
87100
}
88101

89102
if defaultRunAsGroup, ok := cfgMap[defaultRunAsGroupKey]; ok {
90-
tc.DefaultRunAsGroup = defaultRunAsGroup
103+
if defaultRunAsGroup != "" {
104+
runAsGroup, err := strconv.ParseInt(defaultRunAsGroup, 10, 0)
105+
if err != nil {
106+
return nil, fmt.Errorf("failed parsing runAsGroup config %q", defaultRunAsGroup)
107+
}
108+
tc.DefaultRunAsGroup = runAsGroup
109+
} else {
110+
// if runAsGroup is "" don't set runAsGroup in SCC
111+
tc.IsDefaultRunAsGroupEmpty = true
112+
}
91113
}
92114

93115
if defaultRunAsNonRoot, ok := cfgMap[defaultRunAsNonRootKey]; ok {
94116
if defaultRunAsNonRoot != "" {
95117
runAsNonRoot, err := strconv.ParseBool(defaultRunAsNonRoot)
96118
if err != nil {
97-
return nil, fmt.Errorf("failed parsing runAsGroup config %v", defaultRunAsNonRoot)
119+
return nil, fmt.Errorf("failed parsing runAsNonRoot config %q", defaultRunAsNonRoot)
98120
}
99121
tc.DefaultRunAsNonRoot = runAsNonRoot
100122
} else {

‎pkg/apis/config/default_test.go

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,8 @@ func TestNewDefaultsFromConfigMap(t *testing.T) {
3636
{
3737
expectedConfig: &config.Defaults{
3838
DefaultServiceAccount: "default",
39-
DefaultRunAsUser: "65532",
40-
DefaultRunAsGroup: "65532",
39+
DefaultRunAsUser: 65532,
40+
DefaultRunAsGroup: 65532,
4141
DefaultRunAsNonRoot: true,
4242
},
4343
fileName: config.GetDefaultsConfigName(),
@@ -57,8 +57,8 @@ func TestNewDefaultsFromEmptyConfigMap(t *testing.T) {
5757
DefaultsConfigEmptyName := "config-defaults-empty"
5858
expectedConfig := &config.Defaults{
5959
DefaultServiceAccount: "default",
60-
DefaultRunAsUser: "65532",
61-
DefaultRunAsGroup: "65532",
60+
DefaultRunAsUser: 65532,
61+
DefaultRunAsGroup: 65532,
6262
DefaultRunAsNonRoot: true,
6363
}
6464
verifyConfigFileWithExpectedConfig(t, DefaultsConfigEmptyName, expectedConfig)
@@ -67,10 +67,12 @@ func TestNewDefaultsFromEmptyConfigMap(t *testing.T) {
6767
func TestNewDefaultsFromConfigMapWithEmptyVal(t *testing.T) {
6868
DefaultsConfigEmptyVal := "config-defaults-triggers-empty-val"
6969
expectedConfig := &config.Defaults{
70-
DefaultServiceAccount: "default",
71-
DefaultRunAsUser: "",
72-
DefaultRunAsGroup: "",
73-
DefaultRunAsNonRoot: true, // when empty value set from configmap we set back to default value for runAsNonRoot
70+
DefaultServiceAccount: "default",
71+
DefaultRunAsUser: 65532,
72+
DefaultRunAsGroup: 65532,
73+
DefaultRunAsNonRoot: true, // when empty value set from configmap we set back to default value for runAsNonRoot
74+
IsDefaultRunAsUserEmpty: true,
75+
IsDefaultRunAsGroupEmpty: true,
7476
}
7577
verifyConfigFileWithExpectedConfig(t, DefaultsConfigEmptyVal, expectedConfig)
7678
}

‎pkg/reconciler/eventlistener/resources/container.go

Lines changed: 6 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ limitations under the License.
1717
package resources
1818

1919
import (
20-
"errors"
2120
"strconv"
2221

2322
"github.com/tektoncd/triggers/pkg/apis/config"
@@ -30,7 +29,7 @@ import (
3029

3130
type ContainerOption func(*corev1.Container)
3231

33-
func MakeContainer(el *v1beta1.EventListener, configAcc reconcilersource.ConfigAccessor, c Config, cfg *config.Config, opts ...ContainerOption) (corev1.Container, error) {
32+
func MakeContainer(el *v1beta1.EventListener, configAcc reconcilersource.ConfigAccessor, c Config, cfg *config.Config, opts ...ContainerOption) corev1.Container {
3433
isMultiNS := false
3534
if len(el.Spec.NamespaceSelector.MatchNames) != 0 {
3635
isMultiNS = true
@@ -65,19 +64,11 @@ func MakeContainer(el *v1beta1.EventListener, configAcc reconcilersource.ConfigA
6564
}
6665
}
6766

68-
if cfg.Defaults.DefaultRunAsUser != "" {
69-
runAsUser, err := strconv.ParseInt(cfg.Defaults.DefaultRunAsUser, 10, 0)
70-
if err != nil {
71-
return corev1.Container{}, errors.New("failed parsing runAsUser config default-run-as-user")
72-
}
73-
containerSecurityContext.RunAsUser = ptr.Int64(runAsUser)
67+
if !cfg.Defaults.IsDefaultRunAsUserEmpty {
68+
containerSecurityContext.RunAsUser = ptr.Int64(cfg.Defaults.DefaultRunAsUser)
7469
}
75-
if cfg.Defaults.DefaultRunAsGroup != "" {
76-
runAsGroup, err := strconv.ParseInt(cfg.Defaults.DefaultRunAsGroup, 10, 0)
77-
if err != nil {
78-
return corev1.Container{}, errors.New("failed parsing runAsGroup config default-run-as-group")
79-
}
80-
containerSecurityContext.RunAsGroup = ptr.Int64(runAsGroup)
70+
if !cfg.Defaults.IsDefaultRunAsGroupEmpty {
71+
containerSecurityContext.RunAsGroup = ptr.Int64(cfg.Defaults.DefaultRunAsGroup)
8172
}
8273

8374
container := corev1.Container{
@@ -124,5 +115,5 @@ func MakeContainer(el *v1beta1.EventListener, configAcc reconcilersource.ConfigA
124115
opt(&container)
125116
}
126117

127-
return container, nil
118+
return container
128119
}

‎pkg/reconciler/eventlistener/resources/container_test.go

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -483,10 +483,7 @@ func TestContainer(t *testing.T) {
483483

484484
for _, tt := range tests {
485485
t.Run(tt.name, func(t *testing.T) {
486-
got, err := MakeContainer(tt.el, &reconcilersource.EmptyVarsGenerator{}, config, cfg.FromContextOrDefaults(context.Background()), tt.opts...)
487-
if err != nil {
488-
t.Error(err)
489-
}
486+
got := MakeContainer(tt.el, &reconcilersource.EmptyVarsGenerator{}, config, cfg.FromContextOrDefaults(context.Background()), tt.opts...)
490487
if diff := cmp.Diff(tt.want, got); diff != "" {
491488
t.Errorf("MakeContainer() did not return expected. -want, +got: %s", diff)
492489
}

‎pkg/reconciler/eventlistener/resources/custom.go

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ func MakeCustomObject(ctx context.Context, el *v1beta1.EventListener, configAcc
4848
namespace = el.GetNamespace()
4949
}
5050

51-
container, err := MakeContainer(el, configAcc, c, cfg, func(c *corev1.Container) {
51+
container := MakeContainer(el, configAcc, c, cfg, func(c *corev1.Container) {
5252
// handle env and resources for custom object
5353
if len(original.Spec.Template.Spec.Containers) == 1 {
5454
c.Env = append(c.Env, original.Spec.Template.Spec.Containers[0].Env...)
@@ -77,9 +77,6 @@ func MakeCustomObject(ctx context.Context, el *v1beta1.EventListener, configAcc
7777
SuccessThreshold: 1,
7878
}
7979
})
80-
if err != nil {
81-
return nil, err
82-
}
8380

8481
podlabels := kmeta.UnionMaps(FilterLabels(ctx, el.Labels), GenerateLabels(el.Name, c.StaticResourceLabels))
8582

‎pkg/reconciler/eventlistener/resources/deployment.go

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -47,10 +47,7 @@ func MakeDeployment(ctx context.Context, el *v1beta1.EventListener, configAcc re
4747
if err != nil {
4848
return nil, err
4949
}
50-
container, err := MakeContainer(el, configAcc, c, cfg, opt, addCertsForSecureConnection(c))
51-
if err != nil {
52-
return nil, err
53-
}
50+
container := MakeContainer(el, configAcc, c, cfg, opt, addCertsForSecureConnection(c))
5451

5552
filteredLabels := FilterLabels(ctx, el.Labels)
5653

‎pkg/reconciler/eventlistener/resources/deployment_test.go

Lines changed: 46 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -43,27 +43,6 @@ func TestDeployment(t *testing.T) {
4343
"eventlistener": eventListenerName,
4444
}
4545

46-
cData, err := MakeContainer(makeEL(), &reconcilersource.EmptyVarsGenerator{}, config,
47-
cfg.FromContextOrDefaults(context.Background()), mustAddDeployBits(t, makeEL(), config),
48-
addCertsForSecureConnection(config))
49-
if err != nil {
50-
t.Error(err)
51-
}
52-
53-
cDataWithTLS, err := MakeContainer(makeEL(withTLSEnvFrom("Bill")), &reconcilersource.EmptyVarsGenerator{}, config,
54-
cfg.FromContextOrDefaults(context.Background()), mustAddDeployBits(t, makeEL(withTLSEnvFrom("Bill")), config),
55-
addCertsForSecureConnection(config))
56-
if err != nil {
57-
t.Error(err)
58-
}
59-
60-
cDataWithProbes, err := MakeContainer(makeEL(setProbes()), &reconcilersource.EmptyVarsGenerator{}, config,
61-
cfg.FromContextOrDefaults(context.Background()), mustAddDeployBits(t, makeEL(setProbes()), config),
62-
addCertsForSecureConnection(config))
63-
if err != nil {
64-
t.Error(err)
65-
}
66-
6746
tests := []struct {
6847
name string
6948
el *v1beta1.EventListener
@@ -88,8 +67,12 @@ func TestDeployment(t *testing.T) {
8867
},
8968
Spec: corev1.PodSpec{
9069
ServiceAccountName: "sa",
91-
Containers: []corev1.Container{cData},
92-
SecurityContext: &strongerSecurityPolicy,
70+
Containers: []corev1.Container{
71+
MakeContainer(makeEL(), &reconcilersource.EmptyVarsGenerator{}, config,
72+
cfg.FromContextOrDefaults(context.Background()), mustAddDeployBits(t, makeEL(), config),
73+
addCertsForSecureConnection(config)),
74+
},
75+
SecurityContext: &strongerSecurityPolicy,
9376
},
9477
},
9578
},
@@ -119,8 +102,12 @@ func TestDeployment(t *testing.T) {
119102
},
120103
Spec: corev1.PodSpec{
121104
ServiceAccountName: "sa",
122-
Containers: []corev1.Container{cData},
123-
SecurityContext: &strongerSecurityPolicy,
105+
Containers: []corev1.Container{
106+
MakeContainer(makeEL(), &reconcilersource.EmptyVarsGenerator{}, config,
107+
cfg.FromContextOrDefaults(context.Background()), mustAddDeployBits(t, makeEL(), config),
108+
addCertsForSecureConnection(config)),
109+
},
110+
SecurityContext: &strongerSecurityPolicy,
124111
},
125112
},
126113
},
@@ -158,8 +145,12 @@ func TestDeployment(t *testing.T) {
158145
},
159146
Spec: corev1.PodSpec{
160147
ServiceAccountName: "sa",
161-
Containers: []corev1.Container{cData},
162-
SecurityContext: &strongerSecurityPolicy,
148+
Containers: []corev1.Container{
149+
MakeContainer(makeEL(), &reconcilersource.EmptyVarsGenerator{}, config,
150+
cfg.FromContextOrDefaults(context.Background()), mustAddDeployBits(t, makeEL(), config),
151+
addCertsForSecureConnection(config)),
152+
},
153+
SecurityContext: &strongerSecurityPolicy,
163154
Tolerations: []corev1.Toleration{{
164155
Key: "foo",
165156
Value: "bar",
@@ -200,8 +191,12 @@ func TestDeployment(t *testing.T) {
200191
},
201192
Spec: corev1.PodSpec{
202193
ServiceAccountName: "sa",
203-
Containers: []corev1.Container{cData},
204-
SecurityContext: &strongerSecurityPolicy,
194+
Containers: []corev1.Container{
195+
MakeContainer(makeEL(), &reconcilersource.EmptyVarsGenerator{}, config,
196+
cfg.FromContextOrDefaults(context.Background()), mustAddDeployBits(t, makeEL(), config),
197+
addCertsForSecureConnection(config)),
198+
},
199+
SecurityContext: &strongerSecurityPolicy,
205200
NodeSelector: map[string]string{
206201
"foo": "bar",
207202
},
@@ -239,8 +234,12 @@ func TestDeployment(t *testing.T) {
239234
},
240235
Spec: corev1.PodSpec{
241236
ServiceAccountName: "bob",
242-
Containers: []corev1.Container{cData},
243-
SecurityContext: &strongerSecurityPolicy,
237+
Containers: []corev1.Container{
238+
MakeContainer(makeEL(), &reconcilersource.EmptyVarsGenerator{}, config,
239+
cfg.FromContextOrDefaults(context.Background()), mustAddDeployBits(t, makeEL(), config),
240+
addCertsForSecureConnection(config)),
241+
},
242+
SecurityContext: &strongerSecurityPolicy,
244243
},
245244
},
246245
},
@@ -265,7 +264,11 @@ func TestDeployment(t *testing.T) {
265264
},
266265
Spec: corev1.PodSpec{
267266
ServiceAccountName: "sa",
268-
Containers: []corev1.Container{cDataWithTLS},
267+
Containers: []corev1.Container{
268+
MakeContainer(makeEL(withTLSEnvFrom("Bill")), &reconcilersource.EmptyVarsGenerator{}, config,
269+
cfg.FromContextOrDefaults(context.Background()), mustAddDeployBits(t, makeEL(withTLSEnvFrom("Bill")), config),
270+
addCertsForSecureConnection(config)),
271+
},
269272
Volumes: []corev1.Volume{{
270273
Name: "https-connection",
271274
VolumeSource: corev1.VolumeSource{
@@ -315,7 +318,11 @@ func TestDeployment(t *testing.T) {
315318
TopologySpreadConstraints: []corev1.TopologySpreadConstraint{{
316319
MaxSkew: 1,
317320
}},
318-
Containers: []corev1.Container{cData},
321+
Containers: []corev1.Container{
322+
MakeContainer(makeEL(), &reconcilersource.EmptyVarsGenerator{}, config,
323+
cfg.FromContextOrDefaults(context.Background()), mustAddDeployBits(t, makeEL(), config),
324+
addCertsForSecureConnection(config)),
325+
},
319326
SecurityContext: &strongerSecurityPolicy,
320327
},
321328
},
@@ -341,8 +348,12 @@ func TestDeployment(t *testing.T) {
341348
},
342349
Spec: corev1.PodSpec{
343350
ServiceAccountName: "sa",
344-
Containers: []corev1.Container{cDataWithProbes},
345-
SecurityContext: &strongerSecurityPolicy,
351+
Containers: []corev1.Container{
352+
MakeContainer(makeEL(setProbes()), &reconcilersource.EmptyVarsGenerator{}, config,
353+
cfg.FromContextOrDefaults(context.Background()), mustAddDeployBits(t, makeEL(setProbes()), config),
354+
addCertsForSecureConnection(config)),
355+
},
356+
SecurityContext: &strongerSecurityPolicy,
346357
},
347358
},
348359
},

0 commit comments

Comments
 (0)