{ "apiVersion": "v1", "items": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "operator-sdk/primary-resource": "ex-registry-sh-c317ed13/snapshot-sample-c317ed13-7p5zl", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "70f7308", "results.tekton.dev/record": "ex-registry-sh-managed-c317ed13/results/13f707db-58d9-4469-a6c9-7983f06955c5/records/7650a2a9-6ff8-4a96-9060-697ad57750aa", "results.tekton.dev/result": "ex-registry-sh-managed-c317ed13/results/13f707db-58d9-4469-a6c9-7983f06955c5", "results.tekton.dev/stored": "false", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-08-26T21:49:41Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-c317ed13", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-c317ed13-7p5zl", "release.appstudio.openshift.io/namespace": "ex-registry-sh-c317ed13", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-n9qjq", "tekton.dev/pipelineRunUID": "13f707db-58d9-4469-a6c9-7983f06955c5", "tekton.dev/pipelineTask": "collect-data", "tekton.dev/task": "collect-data" }, "name": "managed-n9qjq-collect-data", "namespace": "ex-registry-sh-managed-c317ed13", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-n9qjq", "uid": "13f707db-58d9-4469-a6c9-7983f06955c5" } ], "resourceVersion": "8867", "uid": "7650a2a9-6ff8-4a96-9060-697ad57750aa" }, "spec": { "params": [ { "name": "release", "value": "ex-registry-sh-c317ed13/snapshot-sample-c317ed13-7p5zl" }, { "name": "releasePlan", "value": "ex-registry-sh-c317ed13/source-releaseplan" }, { "name": "releasePlanAdmission", "value": "ex-registry-sh-managed-c317ed13/demo" }, { "name": "releaseServiceConfig", "value": "release-service/release-service-config" }, { "name": "snapshot", "value": "ex-registry-sh-c317ed13/snapshot-sample-c317ed13" }, { "name": "subdirectory", "value": "13f707db-58d9-4469-a6c9-7983f06955c5" }, { "name": "ociStorage", "value": "quay-service.quay/test-org/trusted-artifacts" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, { "name": "pathInRepo", "value": "tasks/managed/collect-data/collect-data.yaml" } ], "resolver": "git" }, "timeout": "3h50m0s" }, "status": { "conditions": [ { "lastTransitionTime": "2026-08-26T21:49:47Z", "message": "pod status \"Ready\":\"False\"; message: \"containers with unready status: [step-collect-data step-check-data-key-sources step-create-trusted-artifact]\"", "reason": "Pending", "status": "Unknown", "type": "Succeeded" } ], "podName": "managed-n9qjq-collect-data-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, "entryPoint": "tasks/managed/collect-data/collect-data.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "startTime": "2026-08-26T21:49:41Z", "steps": [ { "container": "step-collect-data", "name": "collect-data", "provenance": {}, "waiting": { "reason": "PodInitializing" } }, { "container": "step-check-data-key-sources", "name": "check-data-key-sources", "provenance": {}, "waiting": { "reason": "PodInitializing" } }, { "container": "step-create-trusted-artifact", "name": "create-trusted-artifact", "provenance": {}, "waiting": { "reason": "PodInitializing" } } ], "taskSpec": { "description": "Tekton task to collect the information added to the data field of the release resources.\n\nThe purpose of this task is to collect all the data and supply it to the other task in the pipeline by creating\na json file called `data.json` in the workspace.\n\nThis task also stores the passed resources as json files in a workspace.\n\nThe parameters to this task are lowercase instead of camelCase because they are passed from the operator, and the\noperator passes them as lowercase.\n\nA task result is returned for each resource with the relative path to the stored JSON for it in the workspace.\n\nFinally, the task checks that the keys from the correct resource (a key that should come from the\nReleasePlanAdmission should not be present in the Release data section).", "params": [ { "description": "The namespaced name of the Release", "name": "release", "type": "string" }, { "description": "The namespaced name of the ReleasePlan", "name": "releasePlan", "type": "string" }, { "description": "The namespaced name of the ReleasePlanAdmission", "name": "releasePlanAdmission", "type": "string" }, { "description": "The namespaced name of the ReleaseServiceConfig", "name": "releaseServiceConfig", "type": "string" }, { "description": "The namespaced name of the Snapshot", "name": "snapshot", "type": "string" }, { "default": "", "description": "Subdirectory inside the workspace to be used", "name": "subdirectory", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "description": "The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" } ], "results": [ { "description": "The relative path in the workspace to the stored release json", "name": "release", "type": "string" }, { "description": "The relative path in the workspace to the stored releasePlan json", "name": "releasePlan", "type": "string" }, { "description": "The relative path in the workspace to the stored releasePlanAdmission json", "name": "releasePlanAdmission", "type": "string" }, { "description": "The relative path in the workspace to the stored releaseServiceConfig json", "name": "releaseServiceConfig", "type": "string" }, { "description": "The relative path in the workspace to the stored snapshotSpec json", "name": "snapshotSpec", "type": "string" }, { "description": "The relative path in the workspace to the stored data json", "name": "data", "type": "string" }, { "description": "The relative path in the workspace to the results directory", "name": "resultsDir", "type": "string" }, { "description": "single component mode", "name": "singleComponentMode", "type": "string" }, { "description": "name of Snapshot resource", "name": "snapshotName", "type": "string" }, { "description": "namespace where Snapshot is located", "name": "snapshotNamespace", "type": "string" }, { "description": "Build Id where Snapshot originated", "name": "snapshotBuildId", "type": "string" }, { "description": "json object containing git resolver metadata about the running release pipeline", "name": "releasePipelineMetadata", "type": "string" }, { "description": "Produced trusted data artifact", "name": "sourceDataArtifact", "type": "string" }, { "description": "Subdirectory inside the workspace to be used", "name": "subdirectory", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "50m", "memory": "64Mi" } }, "env": [ { "name": "RELEASE", "value": "ex-registry-sh-c317ed13/snapshot-sample-c317ed13-7p5zl" }, { "name": "RELEASE_PLAN", "value": "ex-registry-sh-c317ed13/source-releaseplan" }, { "name": "RELEASE_PLAN_ADMISSION", "value": "ex-registry-sh-managed-c317ed13/demo" }, { "name": "RELEASE_SERVICE_CONFIG", "value": "release-service/release-service-config" }, { "name": "SNAPSHOT", "value": "ex-registry-sh-c317ed13/snapshot-sample-c317ed13" } ], "image": "quay.io/konflux-ci/release-service-utils@sha256:440c27f13adab931460a9371df82d3757b77f7ccc1b7604d737e0c78760a95c9", "name": "collect-data", "script": "#!/usr/bin/env bash\nset -eo pipefail\n\nif [ -f \"/mnt/trusted-ca/ca-bundle.crt\" ]; then\n export SSL_CERT_FILE=\"/mnt/trusted-ca/ca-bundle.crt\"\nfi\n\nset -x\necho -n \"13f707db-58d9-4469-a6c9-7983f06955c5\" \u003e \"/tekton/results/subdirectory\"\n\nRESULTS_DIR_PATH=\"results\"\nif [ -n \"13f707db-58d9-4469-a6c9-7983f06955c5\" ]; then\n mkdir -p \"/var/workdir/release/13f707db-58d9-4469-a6c9-7983f06955c5\"\n RESULTS_DIR_PATH=\"13f707db-58d9-4469-a6c9-7983f06955c5/results\"\nfi\n\nmkdir -p \"/var/workdir/release/$RESULTS_DIR_PATH\"\necho -n \"$RESULTS_DIR_PATH\" \u003e \"/tekton/results/resultsDir\"\n\nRELEASE_PATH=\"13f707db-58d9-4469-a6c9-7983f06955c5/release.json\"\necho -n \"$RELEASE_PATH\" \u003e \"/tekton/results/release\"\nget-resource \"release\" \"${RELEASE}\" | tee \"/var/workdir/release/$RELEASE_PATH\"\n\nRELEASEPLAN_PATH=\"13f707db-58d9-4469-a6c9-7983f06955c5/release_plan.json\"\necho -n \"$RELEASEPLAN_PATH\" \u003e \"/tekton/results/releasePlan\"\nget-resource \"releaseplan\" \"${RELEASE_PLAN}\" | tee \"/var/workdir/release/$RELEASEPLAN_PATH\"\n\nRELEASEPLANADMISSION_PATH=\"13f707db-58d9-4469-a6c9-7983f06955c5/release_plan_admission.json\"\necho -n \"$RELEASEPLANADMISSION_PATH\" \u003e \"/tekton/results/releasePlanAdmission\"\nget-resource \"releaseplanadmission\" \"${RELEASE_PLAN_ADMISSION}\" \\\n | tee \"/var/workdir/release/$RELEASEPLANADMISSION_PATH\"\n\nRELEASESERVICECONFIG_PATH=\"13f707db-58d9-4469-a6c9-7983f06955c5/release_service_config.json\"\necho -n \"$RELEASESERVICECONFIG_PATH\" \u003e \"/tekton/results/releaseServiceConfig\"\nget-resource \"releaseserviceconfig\" \"${RELEASE_SERVICE_CONFIG}\" \\\n | tee \"/var/workdir/release/$RELEASESERVICECONFIG_PATH\"\n\necho -e \"\\nFetching Snapshot Spec\"\nSNAPSHOTSPEC_PATH=\"13f707db-58d9-4469-a6c9-7983f06955c5/snapshot_spec.json\"\necho -n \"$SNAPSHOTSPEC_PATH\" \u003e \"/tekton/results/snapshotSpec\"\n# Empty-string componentGroup is treated as unset; fall back to .application, then drop it.\nget-resource \"snapshot\" \"${SNAPSHOT}\" \"{.spec}\" \\\n | jq '(if (.componentGroup == null or .componentGroup == \"\")\n then .componentGroup = .application else . end)\n | del(.application)' \\\n | tee \"/var/workdir/release/$SNAPSHOTSPEC_PATH\"\nlabels=$(get-resource \"snapshot\" \"${SNAPSHOT}\" \"{.metadata.labels}\")\nBUILD_ID=$(jq -r '.\"appstudio.openshift.io/build-pipelinerun\" // \"\"' \u003c\u003c\u003c \"${labels}\")\necho -n \"${BUILD_ID}\" | tee \"/tekton/results/snapshotBuildId\"\n\necho -e \"\\nGenerating collectors data\"\ncollectors_status=$(get-resource \"release\" \"${RELEASE}\" \"{.status.collectors}\")\necho \"***collectors status\"\necho \"${collectors_status}\"\necho \"***\"\n\ncollectors_result=$(jq -c '\n def deepmerge(a; b):\n reduce b[] as $item (a;\n reduce ($item | keys_unsorted[]) as $key (.;\n $item[$key] as $val | ($val | type) as $type | .[$key] = if ($type == \"object\") then\n deepmerge({}; [if .[$key] == null then {} else .[$key] end, $val])\n elif ($type == \"array\") then\n (.[$key] + $val | unique)\n else\n $val\n end)\n );\n\n # Ensure we safely handle missing collectors\n (.? // {}) as $collectors |\n\n # Flatten and combine the managed and tenant sections\n [($collectors.managed? // {} | to_entries | map(.value)) +\n ($collectors.tenant? // {} | to_entries | map(.value))] |\n flatten |\n deepmerge({}; .)\n' \u003c\u003c\u003c \"${collectors_status}\")\necho \"***collectors\"\njq \u003c\u003c\u003c \"$collectors_result\"\necho \"***\"\n\necho -e \"\\nFetching merged data json\"\nrelease_result=$(get-resource \"release\" \"${RELEASE}\" \"{.spec.data}\")\n\nrelease_plan_result=$(get-resource \"releaseplan\" \"${RELEASE_PLAN}\" \"{.spec.data}\")\n\nrelease_plan_admission_result=$(get-resource \"releaseplanadmission\" \"${RELEASE_PLAN_ADMISSION}\" \\\n \"{.spec.data}\")\n\n# Merge collectors and Release keys. Release has higher priority\nmerged_output=$(merge-json \"$collectors_result\" \"$release_result\")\n\n# Merge now with ReleasePlan keys. ReleasePlan has higher priority\nmerged_output=$(merge-json \"$merged_output\" \"$release_plan_result\")\n\n# Finally merge with ReleasePlanAdmission keys. ReleasePlanAdmission has higher priority\nmerged_output=$(merge-json \"$merged_output\" \"$release_plan_admission_result\")\n\nDATA_PATH=\"13f707db-58d9-4469-a6c9-7983f06955c5/data.json\"\necho -n \"$DATA_PATH\" \u003e \"/tekton/results/data\"\necho \"$merged_output\" | tee \"/var/workdir/release/$DATA_PATH\"\n\n# get pipeline ref info\npipelineref=$(jq -c '.spec.pipeline.pipelineRef' \\\n \"/var/workdir/release/13f707db-58d9-4469-a6c9-7983f06955c5/release_plan_admission.json\")\nresolver=$(jq -r '.resolver // \"\"' \u003c\u003c\u003c \"${pipelineref}\")\nif [ \"${resolver}\" == \"git\" ] ; then\n url=$(jq -r '.params[] | select(.name==\"url\") | .value' \u003c\u003c\u003c \"${pipelineref}\")\n revision=$(jq -r '.params[] | select(.name==\"revision\") | .value' \u003c\u003c\u003c \"${pipelineref}\")\n pathinrepo=$(jq -r '.params[] | select(.name==\"pathInRepo\") | .value' \u003c\u003c\u003c \"${pipelineref}\")\n orgrepo=\"${url#*/*/*/}\"\n org=$(echo \"${orgrepo}\" | cut -f1 -d/)\n repo=$(echo \"${orgrepo}\" | cut -f2 -d/ | cut -d. -f1)\n\n sha=$(curl -s \"https://api.github.com/repos/${org}/${repo}/commits/${revision}\" | jq -r '.sha // \"\"')\n\nfi\n\norg=\"${org:-unknown}\"\nrepo=\"${repo:-unknown}\"\nrevision=\"${revision:-unknown}\"\npathinrepo=\"${pathinrepo:-unknown}\"\nsha=\"${sha:-unknown}\"\n\necho \"\"\necho \"Release Pipeline Ref Info:\"\necho \"--------------------------\"\n\njson=$(jq -n -c \\\n --arg org \"${org}\" \\\n --arg repo \"${repo}\" \\\n --arg revision \"${revision}\" \\\n --arg pathinrepo \"${pathinrepo}\" \\\n --arg sha \"${sha}\" \\\n '$ARGS.named')\n\necho \"${json}\" \u003e \"/tekton/results/releasePipelineMetadata\"\n# pretty print for log message\njq . \u003c\u003c\u003c \"$json\"\n\nSINGLE_COMPONENT_MODE=$(jq -r '.singleComponentMode // \"false\"' \"/var/workdir/release/$DATA_PATH\")\nSNAPSHOT_NAME=$(echo \"${SNAPSHOT}\" | cut -f2 -d/)\nSNAPSHOT_NAMESPACE=$(echo \"${SNAPSHOT}\" | cut -f1 -d/)\n\necho -n \"${SINGLE_COMPONENT_MODE}\" | tee \"/tekton/results/singleComponentMode\"\necho -n \"${SNAPSHOT_NAME}\" | tee \"/tekton/results/snapshotName\"\necho -n \"${SNAPSHOT_NAMESPACE}\" | tee \"/tekton/results/snapshotNamespace\"\n" }, { "computeResources": { "limits": { "memory": "32Mi" }, "requests": { "cpu": "10m", "memory": "32Mi" } }, "image": "quay.io/konflux-ci/release-service-utils@sha256:440c27f13adab931460a9371df82d3757b77f7ccc1b7604d737e0c78760a95c9", "name": "check-data-key-sources", "script": "#!/usr/bin/env bash\nset -ex\n\nDISALLOWED_KEYS_JSON='{\n \"Release\": [\n \"releaseNotes.product_id\",\n \"releaseNotes.product_name\",\n \"releaseNotes.product_version\",\n \"releaseNotes.product_stream\",\n \"releaseNotes.cpe\",\n \"releaseNotes.allow_custom_live_id\"\n ],\n \"ReleasePlan\": [\n \"releaseNotes.product_id\",\n \"releaseNotes.product_name\",\n \"releaseNotes.product_version\",\n \"releaseNotes.product_stream\",\n \"releaseNotes.cpe\",\n \"releaseNotes.allow_custom_live_id\"\n ],\n \"ReleasePlanAdmission\": [\n ]\n}'\n\nRC=0\n\ncheck_source () { # Expected arguments are [CRD from DISALLOWED_KEYS_JSON, file]\n for KEY in $(jq -r \".$1[]\" \u003c\u003c\u003c \"$DISALLOWED_KEYS_JSON\") ; do\n if [[ $(jq \".spec.data.$KEY\" \"$2\") != \"null\" ]] ; then\n echo \"Found disallowed key: $KEY in resource $1\"\n RC=1\n fi\n done\n}\n\ncheck_source \"Release\" \"/var/workdir/release/13f707db-58d9-4469-a6c9-7983f06955c5/release.json\"\ncheck_source \"ReleasePlan\" \"/var/workdir/release/13f707db-58d9-4469-a6c9-7983f06955c5/release_plan.json\"\ncheck_source \"ReleasePlanAdmission\" \\\n \"/var/workdir/release/13f707db-58d9-4469-a6c9-7983f06955c5/release_plan_admission.json\"\n\nexit $RC\n" }, { "args": [ "create", "--store", "quay-service.quay/test-org/trusted-artifacts", "/tekton/results/sourceDataArtifact=/var/workdir/release" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact" } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-c317ed13/snapshot-sample-c317ed13-7p5zl", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "70f7308", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-c317ed13/results/13f707db-58d9-4469-a6c9-7983f06955c5/records/9a91a6b1-00f3-470b-8d14-2e4037d06d86", "results.tekton.dev/result": "ex-registry-sh-managed-c317ed13/results/13f707db-58d9-4469-a6c9-7983f06955c5", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-08-26T21:49:18Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-c317ed13", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-c317ed13-7p5zl", "release.appstudio.openshift.io/namespace": "ex-registry-sh-c317ed13", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-n9qjq", "tekton.dev/pipelineRunUID": "13f707db-58d9-4469-a6c9-7983f06955c5", "tekton.dev/pipelineTask": "verify-access-to-resources", "tekton.dev/task": "verify-access-to-resources" }, "name": "managed-n9qjq-verify-access-to-resources", "namespace": "ex-registry-sh-managed-c317ed13", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-n9qjq", "uid": "13f707db-58d9-4469-a6c9-7983f06955c5" } ], "resourceVersion": "8774", "uid": "9a91a6b1-00f3-470b-8d14-2e4037d06d86" }, "spec": { "params": [ { "name": "release", "value": "ex-registry-sh-c317ed13/snapshot-sample-c317ed13-7p5zl" }, { "name": "releasePlan", "value": "ex-registry-sh-c317ed13/source-releaseplan" }, { "name": "releasePlanAdmission", "value": "ex-registry-sh-managed-c317ed13/demo" }, { "name": "releaseServiceConfig", "value": "release-service/release-service-config" }, { "name": "snapshot", "value": "ex-registry-sh-c317ed13/snapshot-sample-c317ed13" }, { "name": "requireInternalServices", "value": "false" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, { "name": "pathInRepo", "value": "tasks/managed/verify-access-to-resources/verify-access-to-resources.yaml" } ], "resolver": "git" }, "timeout": "3h50m0s" }, "status": { "artifacts": {}, "completionTime": "2026-08-26T21:49:41Z", "conditions": [ { "lastTransitionTime": "2026-08-26T21:49:41Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-n9qjq-verify-access-to-resources-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, "entryPoint": "tasks/managed/verify-access-to-resources/verify-access-to-resources.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "startTime": "2026-08-26T21:49:18Z", "steps": [ { "container": "step-verify-access-to-resources", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "verify-access-to-resources", "provenance": {}, "terminated": { "containerID": "containerd://11f214fd22dca809ea6f6a7f9b559d17e1b816ee60c68d9d8cbb8942e8263625", "exitCode": 0, "finishedAt": "2026-08-26T21:49:38Z", "reason": "Completed", "startedAt": "2026-08-26T21:49:37Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "This Tekton task is used to verify access to various resources in the pipelines. It ensures that the necessary\nresources, such as the release, release plan, release plan admission, release service config and snapshot,\nare available and accessible. Additionally, it checks if internal requests can be created if\n`requireInternalServices` is set to `true`.", "params": [ { "description": "Namespace/name of the Release", "name": "release", "type": "string" }, { "description": "Namespace/name of the ReleasePlan", "name": "releasePlan", "type": "string" }, { "description": "Namespace/name of the ReleasePlanAdmission", "name": "releasePlanAdmission", "type": "string" }, { "description": "Namespace/name of the ReleaseServiceConfig", "name": "releaseServiceConfig", "type": "string" }, { "description": "Namespace/name of the Snapshot", "name": "snapshot", "type": "string" }, { "default": "false", "description": "Whether internal services are required", "name": "requireInternalServices", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "stepTemplate": { "computeResources": {}, "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "computeResources": { "limits": { "memory": "100Mi" }, "requests": { "cpu": "10m", "memory": "100Mi" } }, "image": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "verify-access-to-resources", "script": "#!/usr/bin/env bash\n\nORIGIN_NAMESPACE=\"$(cut -f1 -d/ \u003c\u003c\u003c \"ex-registry-sh-c317ed13/snapshot-sample-c317ed13-7p5zl\")\"\nTARGET_NAMESPACE=\"$(cut -f1 -d/ \u003c\u003c\u003c \"ex-registry-sh-managed-c317ed13/demo\")\"\nRSC_NAMESPACE=\"$(cut -f1 -d/ \u003c\u003c\u003c \"release-service/release-service-config\")\"\n\nRELEASE_NAME=\"$(cut -f2 -d/ \u003c\u003c\u003c \"ex-registry-sh-c317ed13/snapshot-sample-c317ed13-7p5zl\")\"\nRELEASEPLAN_NAME=\"$(cut -f2 -d/ \u003c\u003c\u003c \"ex-registry-sh-c317ed13/source-releaseplan\")\"\nRELEASEPLANADMISSION_NAME=\"$(cut -f2 -d/ \u003c\u003c\u003c \"ex-registry-sh-managed-c317ed13/demo\")\"\nRELEASESERVICECONFIG_NAME=\"$(cut -f2 -d/ \u003c\u003c\u003c \"release-service/release-service-config\")\"\nSNAPSHOT_NAME=\"$(cut -f2 -d/ \u003c\u003c\u003c \"ex-registry-sh-c317ed13/snapshot-sample-c317ed13\")\"\n\nCAN_I_READ_RELEASES=\"$(kubectl auth can-i get release/\"${RELEASE_NAME}\" -n \"${ORIGIN_NAMESPACE}\")\"\nCAN_I_READ_RELEASEPLANS=\"$(kubectl auth can-i get releaseplan/\"${RELEASEPLAN_NAME}\"\\\n -n \"${ORIGIN_NAMESPACE}\")\"\nCAN_I_READ_RELEASEPLANADMISSIONS=\"$(kubectl auth can-i get\\\n releaseplanadmission/\"${RELEASEPLANADMISSION_NAME}\" -n \"${TARGET_NAMESPACE}\")\"\nCAN_I_READ_RELEASESERVICECONFIG=\"$(kubectl auth can-i get\\\n releaseserviceconfig/\"${RELEASESERVICECONFIG_NAME}\" -n \"${RSC_NAMESPACE}\")\"\nCAN_I_READ_SNAPSHOTS=\"$(kubectl auth can-i get snapshot/\"${SNAPSHOT_NAME}\" -n \"${ORIGIN_NAMESPACE}\")\"\n\nif [ \"false\" = \"true\" ]; then\n CAN_I_CREATE_INTERNALREQUESTS=\"$(kubectl auth can-i create internalrequest -n \"${TARGET_NAMESPACE}\")\"\nelse\n CAN_I_CREATE_INTERNALREQUESTS=\"skipped\"\nfi\n\necho \"\"\necho \"CAN_I_READ_RELEASES? ${CAN_I_READ_RELEASES}\"\necho \"CAN_I_READ_RELEASEPLANS? ${CAN_I_READ_RELEASEPLANS}\"\necho \"CAN_I_READ_RELEASEPLANADMISSIONS? ${CAN_I_READ_RELEASEPLANADMISSIONS}\"\necho \"CAN_I_READ_RELEASESERVICECONFIG? ${CAN_I_READ_RELEASESERVICECONFIG}\"\necho \"CAN_I_READ_SNAPSHOTS? ${CAN_I_READ_SNAPSHOTS}\"\necho \"\"\necho \"CAN_I_CREATE_INTERNALREQUESTS? ${CAN_I_CREATE_INTERNALREQUESTS}\"\necho \"\"\n\nif [ \"${CAN_I_READ_RELEASES}\" = \"no\" ] ||\\\n [ \"${CAN_I_READ_RELEASEPLANS}\" = \"no\" ] ||\\\n [ \"${CAN_I_READ_RELEASEPLANADMISSIONS}\" = \"no\" ] ||\\\n [ \"${CAN_I_READ_RELEASESERVICECONFIG}\" = \"no\" ] ||\\\n [ \"${CAN_I_READ_SNAPSHOTS}\" = \"no\" ] ||\\\n [ \"${CAN_I_CREATE_INTERNALREQUESTS}\" = \"no\" ] ; then\n echo \"Error: Cannot read or create required Release resources!\"\n echo \"\"\n echo \"This indicates that your workspace is not correctly setup\"\n echo \"Please reach out to a workspace administrator\"\n exit 1\nfi\n\necho \"Access to Release resources verified\"\n" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } } ], "kind": "List", "metadata": { "resourceVersion": "" } }