{ "apiVersion": "v1", "items": [ { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-de10b91f/snapshot-sample-de10b91f-hwrzj", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "70f7308", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-de10b91f/results/210e8c0c-823f-4257-8bfe-3bc1e1778dad/records/49bd6eb7-ee06-45d6-b713-1a273d71c9dc", "results.tekton.dev/result": "ex-registry-sh-managed-de10b91f/results/210e8c0c-823f-4257-8bfe-3bc1e1778dad", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-08-26T21:49:19Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-de10b91f", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-de10b91f-hwrzj", "release.appstudio.openshift.io/namespace": "ex-registry-sh-de10b91f", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-8cbr4", "tekton.dev/pipelineRunUID": "210e8c0c-823f-4257-8bfe-3bc1e1778dad", "tekton.dev/pipelineTask": "check-data-keys", "tekton.dev/task": "check-data-keys" }, "name": "managed-8cbr4-check-data-keys", "namespace": "ex-registry-sh-managed-de10b91f", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-8cbr4", "uid": "210e8c0c-823f-4257-8bfe-3bc1e1778dad" } ], "resourceVersion": "9281", "uid": "49bd6eb7-ee06-45d6-b713-1a273d71c9dc" }, "spec": { "params": [ { "name": "dataPath", "value": "210e8c0c-823f-4257-8bfe-3bc1e1778dad/data.json" }, { "name": "systems", "value": "[\n {\"systemName\": \"mapping\", \"dynamic\": false}\n]\n" }, { "name": "ociStorage", "value": "quay-service.quay/test-org/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:5472223c83e25c081093eff2a85162f866832d71352ce9c7a9de7d1da2b1df50" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, { "name": "pathInRepo", "value": "tasks/managed/check-data-keys/check-data-keys.yaml" } ], "resolver": "git" }, "timeout": "3h50m0s" }, "status": { "artifacts": {}, "completionTime": "2026-08-26T21:49:49Z", "conditions": [ { "lastTransitionTime": "2026-08-26T21:49:49Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-8cbr4-check-data-keys-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, "entryPoint": "tasks/managed/check-data-keys/check-data-keys.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "sourceDataArtifact", "type": "string", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:a272bc44914654e54393d5b6ae49c17ef0a90a0a49f58001cccbd82a31310086" } ], "startTime": "2026-08-26T21:49:19Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://1155199b091407092ec2cdf1f4feae290926c82d446bf41b6a5648df7eff3fe5", "exitCode": 0, "finishedAt": "2026-08-26T21:49:45Z", "reason": "Completed", "startedAt": "2026-08-26T21:49:45Z" }, "terminationReason": "Completed" }, { "container": "step-check-data-keys", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:282c23415a9995ab3fd6eb79dd314e84aed9b51e96ac3caaa34562c08eb7cc51", "name": "check-data-keys", "provenance": {}, "terminated": { "containerID": "containerd://41f686d98461dfa571d5575fb30be9f6038e1f402b5316ee6f1fc95962ad5c24", "exitCode": 0, "finishedAt": "2026-08-26T21:49:46Z", "reason": "Completed", "startedAt": "2026-08-26T21:49:46Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://ffb625343e6142ec341ecc51d0be09412423d4e8a4c4e2afef54c1e37d994dc0", "exitCode": 0, "finishedAt": "2026-08-26T21:49:47Z", "message": "[{\"key\":\"sourceDataArtifact\",\"value\":\"oci:quay-service.quay/test-org/trusted-artifacts@sha256:a272bc44914654e54393d5b6ae49c17ef0a90a0a49f58001cccbd82a31310086\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-26T21:49:47Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task that validates data keys against a schema to ensure that all required keys for a system(s) are present\nand correctly formatted. The system(s) passed into the `systems` parameter become required.\nThe schema validation also applies to all data passed into the `dataPath` parameter,\nmeaning all the data keys must be allowed and formatted correctly.\n\nFor example, if `releaseNotes` is passed as a system and the data file does not have all the required\nreleaseNotes keys, the schema will give validation errors, and the task will fail.\n\nThe validation schema is bundled in the release-service-utils image at\n`/home/schemas/dataKeys.json`.", "params": [ { "description": "Path to the JSON string of the merged data to use", "name": "dataPath", "type": "string" }, { "default": "", "description": "The systems to check that all data keys are present for", "name": "systems", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "", "description": "Location of trusted artifacts to be used to populate data directory", "name": "sourceDataArtifact", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "description": "The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" } ], "results": [ { "description": "Produced trusted data artifact", "name": "sourceDataArtifact", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay-service.quay/test-org/trusted-artifacts@sha256:5472223c83e25c081093eff2a85162f866832d71352ce9c7a9de7d1da2b1df50=/var/workdir/release" ], "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "30m", "memory": "64Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "command": [ "/home/scripts/python/tasks/managed/check_data_keys.py" ], "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "10m", "memory": "64Mi" } }, "env": [ { "name": "PARAM_DATA_DIR", "value": "/var/workdir/release" }, { "name": "PARAM_DATA_PATH", "value": "210e8c0c-823f-4257-8bfe-3bc1e1778dad/data.json" }, { "name": "PARAM_SYSTEMS", "value": "[\n {\"systemName\": \"mapping\", \"dynamic\": false}\n]\n" } ], "image": "quay.io/konflux-ci/release-service-utils@sha256:282c23415a9995ab3fd6eb79dd314e84aed9b51e96ac3caaa34562c08eb7cc51", "name": "check-data-keys" }, { "args": [ "create", "--store", "quay-service.quay/test-org/trusted-artifacts", "/tekton/results/sourceDataArtifact=/var/workdir/release" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact" } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-de10b91f/snapshot-sample-de10b91f-hwrzj", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "70f7308", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-de10b91f/results/210e8c0c-823f-4257-8bfe-3bc1e1778dad/records/4cb51aad-4a5b-4b25-81f5-7dc5811e4d03", "results.tekton.dev/result": "ex-registry-sh-managed-de10b91f/results/210e8c0c-823f-4257-8bfe-3bc1e1778dad", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-08-26T21:48:44Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-de10b91f", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-de10b91f-hwrzj", "release.appstudio.openshift.io/namespace": "ex-registry-sh-de10b91f", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-8cbr4", "tekton.dev/pipelineRunUID": "210e8c0c-823f-4257-8bfe-3bc1e1778dad", "tekton.dev/pipelineTask": "collect-data", "tekton.dev/task": "collect-data" }, "name": "managed-8cbr4-collect-data", "namespace": "ex-registry-sh-managed-de10b91f", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-8cbr4", "uid": "210e8c0c-823f-4257-8bfe-3bc1e1778dad" } ], "resourceVersion": "8839", "uid": "4cb51aad-4a5b-4b25-81f5-7dc5811e4d03" }, "spec": { "params": [ { "name": "release", "value": "ex-registry-sh-de10b91f/snapshot-sample-de10b91f-hwrzj" }, { "name": "releasePlan", "value": "ex-registry-sh-de10b91f/source-releaseplan" }, { "name": "releasePlanAdmission", "value": "ex-registry-sh-managed-de10b91f/demo" }, { "name": "releaseServiceConfig", "value": "release-service/release-service-config" }, { "name": "snapshot", "value": "ex-registry-sh-de10b91f/snapshot-sample-de10b91f" }, { "name": "subdirectory", "value": "210e8c0c-823f-4257-8bfe-3bc1e1778dad" }, { "name": "ociStorage", "value": "quay-service.quay/test-org/trusted-artifacts" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, { "name": "pathInRepo", "value": "tasks/managed/collect-data/collect-data.yaml" } ], "resolver": "git" }, "timeout": "3h50m0s" }, "status": { "artifacts": {}, "completionTime": "2026-08-26T21:49:19Z", "conditions": [ { "lastTransitionTime": "2026-08-26T21:49:19Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-8cbr4-collect-data-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, "entryPoint": "tasks/managed/collect-data/collect-data.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "data", "type": "string", "value": "210e8c0c-823f-4257-8bfe-3bc1e1778dad/data.json" }, { "name": "release", "type": "string", "value": "210e8c0c-823f-4257-8bfe-3bc1e1778dad/release.json" }, { "name": "releasePipelineMetadata", "type": "string", "value": "{\"org\":\"konflux-ci\",\"repo\":\"release-service-catalog\",\"revision\":\"af03de6a3bdb8dfaba653846f8a50b23bc97d0aa\",\"pathinrepo\":\"pipelines/managed/push-to-external-registry/push-to-external-registry.yaml\",\"sha\":\"af03de6a3bdb8dfaba653846f8a50b23bc97d0aa\"}\n" }, { "name": "releasePlan", "type": "string", "value": "210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_plan.json" }, { "name": "releasePlanAdmission", "type": "string", "value": "210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_plan_admission.json" }, { "name": "releaseServiceConfig", "type": "string", "value": "210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_service_config.json" }, { "name": "resultsDir", "type": "string", "value": "210e8c0c-823f-4257-8bfe-3bc1e1778dad/results" }, { "name": "singleComponentMode", "type": "string", "value": "false" }, { "name": "snapshotBuildId", "type": "string", "value": "" }, { "name": "snapshotName", "type": "string", "value": "snapshot-sample-de10b91f" }, { "name": "snapshotNamespace", "type": "string", "value": "ex-registry-sh-de10b91f" }, { "name": "snapshotSpec", "type": "string", "value": "210e8c0c-823f-4257-8bfe-3bc1e1778dad/snapshot_spec.json" }, { "name": "subdirectory", "type": "string", "value": "210e8c0c-823f-4257-8bfe-3bc1e1778dad" }, { "name": "sourceDataArtifact", "type": "string", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:5472223c83e25c081093eff2a85162f866832d71352ce9c7a9de7d1da2b1df50" } ], "startTime": "2026-08-26T21:48:44Z", "steps": [ { "container": "step-collect-data", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:440c27f13adab931460a9371df82d3757b77f7ccc1b7604d737e0c78760a95c9", "name": "collect-data", "provenance": {}, "terminated": { "containerID": "containerd://19a431b702baf1ab1f2ea9ac73b09c9e19c86fbaeedfa8ef3319d48fea485886", "exitCode": 0, "finishedAt": "2026-08-26T21:49:17Z", "message": "[{\"key\":\"data\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/data.json\",\"type\":1},{\"key\":\"release\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/release.json\",\"type\":1},{\"key\":\"releasePipelineMetadata\",\"value\":\"{\\\"org\\\":\\\"konflux-ci\\\",\\\"repo\\\":\\\"release-service-catalog\\\",\\\"revision\\\":\\\"af03de6a3bdb8dfaba653846f8a50b23bc97d0aa\\\",\\\"pathinrepo\\\":\\\"pipelines/managed/push-to-external-registry/push-to-external-registry.yaml\\\",\\\"sha\\\":\\\"af03de6a3bdb8dfaba653846f8a50b23bc97d0aa\\\"}\\n\",\"type\":1},{\"key\":\"releasePlan\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_plan.json\",\"type\":1},{\"key\":\"releasePlanAdmission\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_plan_admission.json\",\"type\":1},{\"key\":\"releaseServiceConfig\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_service_config.json\",\"type\":1},{\"key\":\"resultsDir\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/results\",\"type\":1},{\"key\":\"singleComponentMode\",\"value\":\"false\",\"type\":1},{\"key\":\"snapshotBuildId\",\"value\":\"\",\"type\":1},{\"key\":\"snapshotName\",\"value\":\"snapshot-sample-de10b91f\",\"type\":1},{\"key\":\"snapshotNamespace\",\"value\":\"ex-registry-sh-de10b91f\",\"type\":1},{\"key\":\"snapshotSpec\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/snapshot_spec.json\",\"type\":1},{\"key\":\"subdirectory\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-26T21:49:15Z" }, "terminationReason": "Completed" }, { "container": "step-check-data-key-sources", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:440c27f13adab931460a9371df82d3757b77f7ccc1b7604d737e0c78760a95c9", "name": "check-data-key-sources", "provenance": {}, "terminated": { "containerID": "containerd://530b4d5190a27e371ea9ecbc08a6237a22f87a3dc3077811c70f2a495df51500", "exitCode": 0, "finishedAt": "2026-08-26T21:49:17Z", "message": "[{\"key\":\"data\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/data.json\",\"type\":1},{\"key\":\"release\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/release.json\",\"type\":1},{\"key\":\"releasePipelineMetadata\",\"value\":\"{\\\"org\\\":\\\"konflux-ci\\\",\\\"repo\\\":\\\"release-service-catalog\\\",\\\"revision\\\":\\\"af03de6a3bdb8dfaba653846f8a50b23bc97d0aa\\\",\\\"pathinrepo\\\":\\\"pipelines/managed/push-to-external-registry/push-to-external-registry.yaml\\\",\\\"sha\\\":\\\"af03de6a3bdb8dfaba653846f8a50b23bc97d0aa\\\"}\\n\",\"type\":1},{\"key\":\"releasePlan\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_plan.json\",\"type\":1},{\"key\":\"releasePlanAdmission\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_plan_admission.json\",\"type\":1},{\"key\":\"releaseServiceConfig\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_service_config.json\",\"type\":1},{\"key\":\"resultsDir\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/results\",\"type\":1},{\"key\":\"singleComponentMode\",\"value\":\"false\",\"type\":1},{\"key\":\"snapshotBuildId\",\"value\":\"\",\"type\":1},{\"key\":\"snapshotName\",\"value\":\"snapshot-sample-de10b91f\",\"type\":1},{\"key\":\"snapshotNamespace\",\"value\":\"ex-registry-sh-de10b91f\",\"type\":1},{\"key\":\"snapshotSpec\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/snapshot_spec.json\",\"type\":1},{\"key\":\"subdirectory\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-26T21:49:17Z" }, "terminationReason": "Completed" }, { "container": "step-create-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://bb670aefd918eb0471b4effe69845cefdbc3f12bf1994f81b851cb1df1d6f6f4", "exitCode": 0, "finishedAt": "2026-08-26T21:49:18Z", "message": "[{\"key\":\"data\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/data.json\",\"type\":1},{\"key\":\"release\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/release.json\",\"type\":1},{\"key\":\"releasePipelineMetadata\",\"value\":\"{\\\"org\\\":\\\"konflux-ci\\\",\\\"repo\\\":\\\"release-service-catalog\\\",\\\"revision\\\":\\\"af03de6a3bdb8dfaba653846f8a50b23bc97d0aa\\\",\\\"pathinrepo\\\":\\\"pipelines/managed/push-to-external-registry/push-to-external-registry.yaml\\\",\\\"sha\\\":\\\"af03de6a3bdb8dfaba653846f8a50b23bc97d0aa\\\"}\\n\",\"type\":1},{\"key\":\"releasePlan\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_plan.json\",\"type\":1},{\"key\":\"releasePlanAdmission\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_plan_admission.json\",\"type\":1},{\"key\":\"releaseServiceConfig\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_service_config.json\",\"type\":1},{\"key\":\"resultsDir\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/results\",\"type\":1},{\"key\":\"singleComponentMode\",\"value\":\"false\",\"type\":1},{\"key\":\"snapshotBuildId\",\"value\":\"\",\"type\":1},{\"key\":\"snapshotName\",\"value\":\"snapshot-sample-de10b91f\",\"type\":1},{\"key\":\"snapshotNamespace\",\"value\":\"ex-registry-sh-de10b91f\",\"type\":1},{\"key\":\"snapshotSpec\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/snapshot_spec.json\",\"type\":1},{\"key\":\"sourceDataArtifact\",\"value\":\"oci:quay-service.quay/test-org/trusted-artifacts@sha256:5472223c83e25c081093eff2a85162f866832d71352ce9c7a9de7d1da2b1df50\",\"type\":1},{\"key\":\"subdirectory\",\"value\":\"210e8c0c-823f-4257-8bfe-3bc1e1778dad\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-26T21:49:17Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task to collect the information added to the data field of the release resources.\n\nThe purpose of this task is to collect all the data and supply it to the other task in the pipeline by creating\na json file called `data.json` in the workspace.\n\nThis task also stores the passed resources as json files in a workspace.\n\nThe parameters to this task are lowercase instead of camelCase because they are passed from the operator, and the\noperator passes them as lowercase.\n\nA task result is returned for each resource with the relative path to the stored JSON for it in the workspace.\n\nFinally, the task checks that the keys from the correct resource (a key that should come from the\nReleasePlanAdmission should not be present in the Release data section).", "params": [ { "description": "The namespaced name of the Release", "name": "release", "type": "string" }, { "description": "The namespaced name of the ReleasePlan", "name": "releasePlan", "type": "string" }, { "description": "The namespaced name of the ReleasePlanAdmission", "name": "releasePlanAdmission", "type": "string" }, { "description": "The namespaced name of the ReleaseServiceConfig", "name": "releaseServiceConfig", "type": "string" }, { "description": "The namespaced name of the Snapshot", "name": "snapshot", "type": "string" }, { "default": "", "description": "Subdirectory inside the workspace to be used", "name": "subdirectory", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "description": "The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" } ], "results": [ { "description": "The relative path in the workspace to the stored release json", "name": "release", "type": "string" }, { "description": "The relative path in the workspace to the stored releasePlan json", "name": "releasePlan", "type": "string" }, { "description": "The relative path in the workspace to the stored releasePlanAdmission json", "name": "releasePlanAdmission", "type": "string" }, { "description": "The relative path in the workspace to the stored releaseServiceConfig json", "name": "releaseServiceConfig", "type": "string" }, { "description": "The relative path in the workspace to the stored snapshotSpec json", "name": "snapshotSpec", "type": "string" }, { "description": "The relative path in the workspace to the stored data json", "name": "data", "type": "string" }, { "description": "The relative path in the workspace to the results directory", "name": "resultsDir", "type": "string" }, { "description": "single component mode", "name": "singleComponentMode", "type": "string" }, { "description": "name of Snapshot resource", "name": "snapshotName", "type": "string" }, { "description": "namespace where Snapshot is located", "name": "snapshotNamespace", "type": "string" }, { "description": "Build Id where Snapshot originated", "name": "snapshotBuildId", "type": "string" }, { "description": "json object containing git resolver metadata about the running release pipeline", "name": "releasePipelineMetadata", "type": "string" }, { "description": "Produced trusted data artifact", "name": "sourceDataArtifact", "type": "string" }, { "description": "Subdirectory inside the workspace to be used", "name": "subdirectory", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "50m", "memory": "64Mi" } }, "env": [ { "name": "RELEASE", "value": "ex-registry-sh-de10b91f/snapshot-sample-de10b91f-hwrzj" }, { "name": "RELEASE_PLAN", "value": "ex-registry-sh-de10b91f/source-releaseplan" }, { "name": "RELEASE_PLAN_ADMISSION", "value": "ex-registry-sh-managed-de10b91f/demo" }, { "name": "RELEASE_SERVICE_CONFIG", "value": "release-service/release-service-config" }, { "name": "SNAPSHOT", "value": "ex-registry-sh-de10b91f/snapshot-sample-de10b91f" } ], "image": "quay.io/konflux-ci/release-service-utils@sha256:440c27f13adab931460a9371df82d3757b77f7ccc1b7604d737e0c78760a95c9", "name": "collect-data", "script": "#!/usr/bin/env bash\nset -eo pipefail\n\nif [ -f \"/mnt/trusted-ca/ca-bundle.crt\" ]; then\n export SSL_CERT_FILE=\"/mnt/trusted-ca/ca-bundle.crt\"\nfi\n\nset -x\necho -n \"210e8c0c-823f-4257-8bfe-3bc1e1778dad\" \u003e \"/tekton/results/subdirectory\"\n\nRESULTS_DIR_PATH=\"results\"\nif [ -n \"210e8c0c-823f-4257-8bfe-3bc1e1778dad\" ]; then\n mkdir -p \"/var/workdir/release/210e8c0c-823f-4257-8bfe-3bc1e1778dad\"\n RESULTS_DIR_PATH=\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/results\"\nfi\n\nmkdir -p \"/var/workdir/release/$RESULTS_DIR_PATH\"\necho -n \"$RESULTS_DIR_PATH\" \u003e \"/tekton/results/resultsDir\"\n\nRELEASE_PATH=\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/release.json\"\necho -n \"$RELEASE_PATH\" \u003e \"/tekton/results/release\"\nget-resource \"release\" \"${RELEASE}\" | tee \"/var/workdir/release/$RELEASE_PATH\"\n\nRELEASEPLAN_PATH=\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_plan.json\"\necho -n \"$RELEASEPLAN_PATH\" \u003e \"/tekton/results/releasePlan\"\nget-resource \"releaseplan\" \"${RELEASE_PLAN}\" | tee \"/var/workdir/release/$RELEASEPLAN_PATH\"\n\nRELEASEPLANADMISSION_PATH=\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_plan_admission.json\"\necho -n \"$RELEASEPLANADMISSION_PATH\" \u003e \"/tekton/results/releasePlanAdmission\"\nget-resource \"releaseplanadmission\" \"${RELEASE_PLAN_ADMISSION}\" \\\n | tee \"/var/workdir/release/$RELEASEPLANADMISSION_PATH\"\n\nRELEASESERVICECONFIG_PATH=\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_service_config.json\"\necho -n \"$RELEASESERVICECONFIG_PATH\" \u003e \"/tekton/results/releaseServiceConfig\"\nget-resource \"releaseserviceconfig\" \"${RELEASE_SERVICE_CONFIG}\" \\\n | tee \"/var/workdir/release/$RELEASESERVICECONFIG_PATH\"\n\necho -e \"\\nFetching Snapshot Spec\"\nSNAPSHOTSPEC_PATH=\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/snapshot_spec.json\"\necho -n \"$SNAPSHOTSPEC_PATH\" \u003e \"/tekton/results/snapshotSpec\"\n# Empty-string componentGroup is treated as unset; fall back to .application, then drop it.\nget-resource \"snapshot\" \"${SNAPSHOT}\" \"{.spec}\" \\\n | jq '(if (.componentGroup == null or .componentGroup == \"\")\n then .componentGroup = .application else . end)\n | del(.application)' \\\n | tee \"/var/workdir/release/$SNAPSHOTSPEC_PATH\"\nlabels=$(get-resource \"snapshot\" \"${SNAPSHOT}\" \"{.metadata.labels}\")\nBUILD_ID=$(jq -r '.\"appstudio.openshift.io/build-pipelinerun\" // \"\"' \u003c\u003c\u003c \"${labels}\")\necho -n \"${BUILD_ID}\" | tee \"/tekton/results/snapshotBuildId\"\n\necho -e \"\\nGenerating collectors data\"\ncollectors_status=$(get-resource \"release\" \"${RELEASE}\" \"{.status.collectors}\")\necho \"***collectors status\"\necho \"${collectors_status}\"\necho \"***\"\n\ncollectors_result=$(jq -c '\n def deepmerge(a; b):\n reduce b[] as $item (a;\n reduce ($item | keys_unsorted[]) as $key (.;\n $item[$key] as $val | ($val | type) as $type | .[$key] = if ($type == \"object\") then\n deepmerge({}; [if .[$key] == null then {} else .[$key] end, $val])\n elif ($type == \"array\") then\n (.[$key] + $val | unique)\n else\n $val\n end)\n );\n\n # Ensure we safely handle missing collectors\n (.? // {}) as $collectors |\n\n # Flatten and combine the managed and tenant sections\n [($collectors.managed? // {} | to_entries | map(.value)) +\n ($collectors.tenant? // {} | to_entries | map(.value))] |\n flatten |\n deepmerge({}; .)\n' \u003c\u003c\u003c \"${collectors_status}\")\necho \"***collectors\"\njq \u003c\u003c\u003c \"$collectors_result\"\necho \"***\"\n\necho -e \"\\nFetching merged data json\"\nrelease_result=$(get-resource \"release\" \"${RELEASE}\" \"{.spec.data}\")\n\nrelease_plan_result=$(get-resource \"releaseplan\" \"${RELEASE_PLAN}\" \"{.spec.data}\")\n\nrelease_plan_admission_result=$(get-resource \"releaseplanadmission\" \"${RELEASE_PLAN_ADMISSION}\" \\\n \"{.spec.data}\")\n\n# Merge collectors and Release keys. Release has higher priority\nmerged_output=$(merge-json \"$collectors_result\" \"$release_result\")\n\n# Merge now with ReleasePlan keys. ReleasePlan has higher priority\nmerged_output=$(merge-json \"$merged_output\" \"$release_plan_result\")\n\n# Finally merge with ReleasePlanAdmission keys. ReleasePlanAdmission has higher priority\nmerged_output=$(merge-json \"$merged_output\" \"$release_plan_admission_result\")\n\nDATA_PATH=\"210e8c0c-823f-4257-8bfe-3bc1e1778dad/data.json\"\necho -n \"$DATA_PATH\" \u003e \"/tekton/results/data\"\necho \"$merged_output\" | tee \"/var/workdir/release/$DATA_PATH\"\n\n# get pipeline ref info\npipelineref=$(jq -c '.spec.pipeline.pipelineRef' \\\n \"/var/workdir/release/210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_plan_admission.json\")\nresolver=$(jq -r '.resolver // \"\"' \u003c\u003c\u003c \"${pipelineref}\")\nif [ \"${resolver}\" == \"git\" ] ; then\n url=$(jq -r '.params[] | select(.name==\"url\") | .value' \u003c\u003c\u003c \"${pipelineref}\")\n revision=$(jq -r '.params[] | select(.name==\"revision\") | .value' \u003c\u003c\u003c \"${pipelineref}\")\n pathinrepo=$(jq -r '.params[] | select(.name==\"pathInRepo\") | .value' \u003c\u003c\u003c \"${pipelineref}\")\n orgrepo=\"${url#*/*/*/}\"\n org=$(echo \"${orgrepo}\" | cut -f1 -d/)\n repo=$(echo \"${orgrepo}\" | cut -f2 -d/ | cut -d. -f1)\n\n sha=$(curl -s \"https://api.github.com/repos/${org}/${repo}/commits/${revision}\" | jq -r '.sha // \"\"')\n\nfi\n\norg=\"${org:-unknown}\"\nrepo=\"${repo:-unknown}\"\nrevision=\"${revision:-unknown}\"\npathinrepo=\"${pathinrepo:-unknown}\"\nsha=\"${sha:-unknown}\"\n\necho \"\"\necho \"Release Pipeline Ref Info:\"\necho \"--------------------------\"\n\njson=$(jq -n -c \\\n --arg org \"${org}\" \\\n --arg repo \"${repo}\" \\\n --arg revision \"${revision}\" \\\n --arg pathinrepo \"${pathinrepo}\" \\\n --arg sha \"${sha}\" \\\n '$ARGS.named')\n\necho \"${json}\" \u003e \"/tekton/results/releasePipelineMetadata\"\n# pretty print for log message\njq . \u003c\u003c\u003c \"$json\"\n\nSINGLE_COMPONENT_MODE=$(jq -r '.singleComponentMode // \"false\"' \"/var/workdir/release/$DATA_PATH\")\nSNAPSHOT_NAME=$(echo \"${SNAPSHOT}\" | cut -f2 -d/)\nSNAPSHOT_NAMESPACE=$(echo \"${SNAPSHOT}\" | cut -f1 -d/)\n\necho -n \"${SINGLE_COMPONENT_MODE}\" | tee \"/tekton/results/singleComponentMode\"\necho -n \"${SNAPSHOT_NAME}\" | tee \"/tekton/results/snapshotName\"\necho -n \"${SNAPSHOT_NAMESPACE}\" | tee \"/tekton/results/snapshotNamespace\"\n" }, { "computeResources": { "limits": { "memory": "32Mi" }, "requests": { "cpu": "10m", "memory": "32Mi" } }, "image": "quay.io/konflux-ci/release-service-utils@sha256:440c27f13adab931460a9371df82d3757b77f7ccc1b7604d737e0c78760a95c9", "name": "check-data-key-sources", "script": "#!/usr/bin/env bash\nset -ex\n\nDISALLOWED_KEYS_JSON='{\n \"Release\": [\n \"releaseNotes.product_id\",\n \"releaseNotes.product_name\",\n \"releaseNotes.product_version\",\n \"releaseNotes.product_stream\",\n \"releaseNotes.cpe\",\n \"releaseNotes.allow_custom_live_id\"\n ],\n \"ReleasePlan\": [\n \"releaseNotes.product_id\",\n \"releaseNotes.product_name\",\n \"releaseNotes.product_version\",\n \"releaseNotes.product_stream\",\n \"releaseNotes.cpe\",\n \"releaseNotes.allow_custom_live_id\"\n ],\n \"ReleasePlanAdmission\": [\n ]\n}'\n\nRC=0\n\ncheck_source () { # Expected arguments are [CRD from DISALLOWED_KEYS_JSON, file]\n for KEY in $(jq -r \".$1[]\" \u003c\u003c\u003c \"$DISALLOWED_KEYS_JSON\") ; do\n if [[ $(jq \".spec.data.$KEY\" \"$2\") != \"null\" ]] ; then\n echo \"Found disallowed key: $KEY in resource $1\"\n RC=1\n fi\n done\n}\n\ncheck_source \"Release\" \"/var/workdir/release/210e8c0c-823f-4257-8bfe-3bc1e1778dad/release.json\"\ncheck_source \"ReleasePlan\" \"/var/workdir/release/210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_plan.json\"\ncheck_source \"ReleasePlanAdmission\" \\\n \"/var/workdir/release/210e8c0c-823f-4257-8bfe-3bc1e1778dad/release_plan_admission.json\"\n\nexit $RC\n" }, { "args": [ "create", "--store", "quay-service.quay/test-org/trusted-artifacts", "/tekton/results/sourceDataArtifact=/var/workdir/release" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact" } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "operator-sdk/primary-resource": "ex-registry-sh-de10b91f/snapshot-sample-de10b91f-hwrzj", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "70f7308", "results.tekton.dev/record": "ex-registry-sh-managed-de10b91f/results/210e8c0c-823f-4257-8bfe-3bc1e1778dad/records/21a54f76-062c-4616-9a98-2692c09829c8", "results.tekton.dev/result": "ex-registry-sh-managed-de10b91f/results/210e8c0c-823f-4257-8bfe-3bc1e1778dad", "results.tekton.dev/stored": "false", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-08-26T21:49:19Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-de10b91f", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-de10b91f-hwrzj", "release.appstudio.openshift.io/namespace": "ex-registry-sh-de10b91f", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-8cbr4", "tekton.dev/pipelineRunUID": "210e8c0c-823f-4257-8bfe-3bc1e1778dad", "tekton.dev/pipelineTask": "collect-registry-token-secret", "tekton.dev/task": "collect-registry-token-secret" }, "name": "managed-8cbr4-collect-registry-token-secret", "namespace": "ex-registry-sh-managed-de10b91f", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-8cbr4", "uid": "210e8c0c-823f-4257-8bfe-3bc1e1778dad" } ], "resourceVersion": "9094", "uid": "21a54f76-062c-4616-9a98-2692c09829c8" }, "spec": { "params": [ { "name": "dataPath", "value": "210e8c0c-823f-4257-8bfe-3bc1e1778dad/data.json" }, { "name": "ociStorage", "value": "quay-service.quay/test-org/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:5472223c83e25c081093eff2a85162f866832d71352ce9c7a9de7d1da2b1df50" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, { "name": "pathInRepo", "value": "tasks/managed/collect-registry-token-secret/collect-registry-token-secret.yaml" } ], "resolver": "git" }, "timeout": "3h50m0s" }, "status": { "conditions": [ { "lastTransitionTime": "2026-08-26T21:49:23Z", "message": "pod status \"Ready\":\"False\"; message: \"containers with unready status: [step-use-trusted-artifact step-collect-secret]\"", "reason": "Pending", "status": "Unknown", "type": "Succeeded" } ], "podName": "managed-8cbr4-collect-registry-token-secret-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, "entryPoint": "tasks/managed/collect-registry-token-secret/collect-registry-token-secret.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "startTime": "2026-08-26T21:49:21Z", "steps": [ { "container": "step-use-trusted-artifact", "name": "use-trusted-artifact", "provenance": {}, "waiting": { "reason": "PodInitializing" } }, { "container": "step-collect-secret", "name": "collect-secret", "provenance": {}, "waiting": { "reason": "PodInitializing" } } ], "taskSpec": { "description": "Tekton task that collects secret name containing registry token from the data file", "params": [ { "description": "Path to the merged data JSON file generated by collect-data task", "name": "dataPath", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "", "description": "Location of trusted artifacts to be used to populate data directory", "name": "sourceDataArtifact", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "description": "The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" } ], "results": [ { "description": "The kube secret to use quay.io API, containing one key: token", "name": "registrySecret", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay-service.quay/test-org/trusted-artifacts@sha256:5472223c83e25c081093eff2a85162f866832d71352ce9c7a9de7d1da2b1df50=/var/workdir/release" ], "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "30m", "memory": "64Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "command": [ "python3", "/home/scripts/python/tasks/managed/collect_registry_token_secret.py" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "50m", "memory": "128Mi" } }, "env": [ { "name": "PARAM_DATA_DIR", "value": "/var/workdir/release" }, { "name": "PARAM_DATA_PATH", "value": "210e8c0c-823f-4257-8bfe-3bc1e1778dad/data.json" }, { "name": "RESULT_REGISTRY_SECRET", "value": "/tekton/results/registrySecret" } ], "image": "quay.io/konflux-ci/release-service-utils@sha256:534529b2450a67cce9779fa19f1b0808ebd8718baf349f8c79db6cf99ad522dc", "name": "collect-secret" } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-de10b91f/snapshot-sample-de10b91f-hwrzj", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "70f7308", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-de10b91f/results/210e8c0c-823f-4257-8bfe-3bc1e1778dad/records/6088b4b2-58fb-464b-bbc4-e9caccaed99a", "results.tekton.dev/result": "ex-registry-sh-managed-de10b91f/results/210e8c0c-823f-4257-8bfe-3bc1e1778dad", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-08-26T21:49:19Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-de10b91f", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-de10b91f-hwrzj", "release.appstudio.openshift.io/namespace": "ex-registry-sh-de10b91f", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-8cbr4", "tekton.dev/pipelineRunUID": "210e8c0c-823f-4257-8bfe-3bc1e1778dad", "tekton.dev/pipelineTask": "collect-signing-params", "tekton.dev/task": "collect-signing-params" }, "name": "managed-8cbr4-collect-signing-params", "namespace": "ex-registry-sh-managed-de10b91f", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-8cbr4", "uid": "210e8c0c-823f-4257-8bfe-3bc1e1778dad" } ], "resourceVersion": "9190", "uid": "6088b4b2-58fb-464b-bbc4-e9caccaed99a" }, "spec": { "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, { "name": "pathInRepo", "value": "tasks/managed/collect-signing-params/collect-signing-params.yaml" } ], "resolver": "git" }, "timeout": "3h50m0s" }, "status": { "artifacts": {}, "completionTime": "2026-08-26T21:49:30Z", "conditions": [ { "lastTransitionTime": "2026-08-26T21:49:30Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-8cbr4-collect-signing-params-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, "entryPoint": "tasks/managed/collect-signing-params/collect-signing-params.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "buildIdentityRegexp", "type": "string", "value": "" }, { "name": "defaultOIDCIssuer", "type": "string", "value": "" }, { "name": "enableKeylessSigning", "type": "string", "value": "" }, { "name": "fulcioExternalUrl", "type": "string", "value": "" }, { "name": "fulcioUrl", "type": "string", "value": "" }, { "name": "rekorExternalUrl", "type": "string", "value": "" }, { "name": "rekorUrl", "type": "string", "value": "" }, { "name": "tektonChainsIdentity", "type": "string", "value": "" }, { "name": "tufExternalUrl", "type": "string", "value": "" }, { "name": "tufUrl", "type": "string", "value": "" } ], "startTime": "2026-08-26T21:49:19Z", "steps": [ { "container": "step-collect-signing-params", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "collect-signing-params", "provenance": {}, "terminated": { "containerID": "containerd://74fc4a0c499b0f332f310a8a2256f5a15fff46d2b049c98a98cfee404a3e61aa", "exitCode": 0, "finishedAt": "2026-08-26T21:49:29Z", "message": "[{\"key\":\"buildIdentityRegexp\",\"value\":\"\",\"type\":1},{\"key\":\"defaultOIDCIssuer\",\"value\":\"\",\"type\":1},{\"key\":\"enableKeylessSigning\",\"value\":\"\",\"type\":1},{\"key\":\"fulcioExternalUrl\",\"value\":\"\",\"type\":1},{\"key\":\"fulcioUrl\",\"value\":\"\",\"type\":1},{\"key\":\"rekorExternalUrl\",\"value\":\"\",\"type\":1},{\"key\":\"rekorUrl\",\"value\":\"\",\"type\":1},{\"key\":\"tektonChainsIdentity\",\"value\":\"\",\"type\":1},{\"key\":\"tufExternalUrl\",\"value\":\"\",\"type\":1},{\"key\":\"tufUrl\",\"value\":\"\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-26T21:49:24Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task to collect Konflux configuration parameters related to\nkeyless signing using cosign. The task attempts to read the \"cluster-config\"\nConfigMap in the \"konflux-info\" namespace to extract signing parameters.\n\nIn case the ConfigMap is not found, the task will output empty strings for all parameters,\nallowing the pipeline to continue without signing parameters.", "params": [ { "default": "cluster-config", "description": "The name of the ConfigMap to read signing parameters from", "name": "configMapName", "type": "string" }, { "default": "konflux-info", "description": "The namespace where the ConfigMap is located", "name": "configMapNamespace", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "results": [ { "description": "A flag indicating whether keyless signing should be enabled, based on the presence of signing parameters.\n", "name": "enableKeylessSigning", "type": "string" }, { "description": "A default OIDC issuer URL to be used for signing.\n", "name": "defaultOIDCIssuer", "type": "string" }, { "description": "The external URL of the Rekor transparency log.\n", "name": "rekorExternalUrl", "type": "string" }, { "description": "The internal URL of the Rekor transparency log.\n", "name": "rekorUrl", "type": "string" }, { "description": "The external URL of the Fulcio certificate authority.\n", "name": "fulcioExternalUrl", "type": "string" }, { "description": "The URL of the Fulcio certificate authority.\n", "name": "fulcioUrl", "type": "string" }, { "description": "The external URL of the TUF repository.\n", "name": "tufExternalUrl", "type": "string" }, { "description": "The URL of the TUF repository.\n", "name": "tufUrl", "type": "string" }, { "description": "A regular expression to extract build identity from the OIDC token claims, if applicable.\n", "name": "buildIdentityRegexp", "type": "string" }, { "description": "The identity used in the certificate, generated by fulcio.\n", "name": "tektonChainsIdentity", "type": "string" } ], "stepTemplate": { "computeResources": {}, "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "computeResources": { "limits": { "cpu": "50m", "memory": "128Mi" }, "requests": { "cpu": "50m", "memory": "128Mi" } }, "image": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "collect-signing-params", "script": "#!/usr/bin/env bash\necho \"Getting cluster-config ConfigMap\"\nKFLX_CONFIG_PATH='/tmp/konflux_config.json'\n\n# Attempt to fetch the ConfigMap with retries, capture exit code\nif retry 3 kubectl get configmap \"cluster-config\" -n \"konflux-info\" -o json \u003e \\\n\"$KFLX_CONFIG_PATH\" 2\u003e/dev/null; then\n echo \"ConfigMap found, extracting signing parameters\"\n\n # Extract signing parameters from ConfigMap data, defaulting to empty string if not found\n enableKeylessSigning=$(jq -r '.data.enableKeylessSigning // \"\"' \"$KFLX_CONFIG_PATH\")\n defaultOIDCIssuer=$(jq -r '.data.defaultOIDCIssuer // \"\"' \"$KFLX_CONFIG_PATH\")\n rekorExternalUrl=$(jq -r '.data.rekorExternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n rekorInternalUrl=$(jq -r '.data.rekorInternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n fulcioExternalUrl=$(jq -r '.data.fulcioExternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n fulcioInternalUrl=$(jq -r '.data.fulcioInternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n tufExternalUrl=$(jq -r '.data.tufExternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n tufInternalUrl=$(jq -r '.data.tufInternalUrl // \"\"' \"$KFLX_CONFIG_PATH\")\n buildIdentityRegexp=$(jq -r '.data.buildIdentityRegexp // \"\"' \"$KFLX_CONFIG_PATH\")\n tektonChainsIdentity=$(jq -r '.data.tektonChainsIdentity // \"\"' \"$KFLX_CONFIG_PATH\")\nelse\n echo \"ConfigMap not found, using default empty values\"\n\n # Set all parameters to empty strings when ConfigMap doesn't exist\n enableKeylessSigning=\"false\"\n defaultOIDCIssuer=\"\"\n rekorExternalUrl=\"\"\n rekorInternalUrl=\"\"\n fulcioExternalUrl=\"\"\n fulcioInternalUrl=\"\"\n tufExternalUrl=\"\"\n tufInternalUrl=\"\"\n buildIdentityRegexp=\"\"\n tektonChainsIdentity=\"\"\nfi\n\n# Write the values to the respective result paths and print them\necho -n \"$enableKeylessSigning\" | tee \"/tekton/results/enableKeylessSigning\"\necho -n \"$defaultOIDCIssuer\" | tee \"/tekton/results/defaultOIDCIssuer\"\necho -n \"$rekorExternalUrl\" | tee \"/tekton/results/rekorExternalUrl\"\nprefer_internal_or_external() {\n local internal=\"$1\"\n local external=\"$2\"\n local result_path=\"$3\"\n\n if [ -n \"$internal\" ]; then\n echo -n \"$internal\" | tee \"$result_path\"\n else\n echo -n \"$external\" | tee \"$result_path\"\n fi\n}\n\nprefer_internal_or_external \"$rekorInternalUrl\" \"$rekorExternalUrl\" \"/tekton/results/rekorUrl\"\necho -n \"$fulcioExternalUrl\" | tee \"/tekton/results/fulcioExternalUrl\"\nprefer_internal_or_external \"$fulcioInternalUrl\" \"$fulcioExternalUrl\" \"/tekton/results/fulcioUrl\"\necho -n \"$tufExternalUrl\" | tee \"/tekton/results/tufExternalUrl\"\nprefer_internal_or_external \"$tufInternalUrl\" \"$tufExternalUrl\" \"/tekton/results/tufUrl\"\necho -n \"$buildIdentityRegexp\" | tee \"/tekton/results/buildIdentityRegexp\"\necho -n \"$tektonChainsIdentity\" | tee \"/tekton/results/tektonChainsIdentity\"\n" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-de10b91f/snapshot-sample-de10b91f-hwrzj", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "70f7308", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-de10b91f/results/210e8c0c-823f-4257-8bfe-3bc1e1778dad/records/5367ff00-1c9b-4f70-86a8-a7511f06b138", "results.tekton.dev/result": "ex-registry-sh-managed-de10b91f/results/210e8c0c-823f-4257-8bfe-3bc1e1778dad", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-08-26T21:49:19Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-de10b91f", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-de10b91f-hwrzj", "release.appstudio.openshift.io/namespace": "ex-registry-sh-de10b91f", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-8cbr4", "tekton.dev/pipelineRunUID": "210e8c0c-823f-4257-8bfe-3bc1e1778dad", "tekton.dev/pipelineTask": "collect-task-params", "tekton.dev/task": "collect-task-params" }, "name": "managed-8cbr4-collect-task-params", "namespace": "ex-registry-sh-managed-de10b91f", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-8cbr4", "uid": "210e8c0c-823f-4257-8bfe-3bc1e1778dad" } ], "resourceVersion": "9182", "uid": "5367ff00-1c9b-4f70-86a8-a7511f06b138" }, "spec": { "params": [ { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "dataPath", "value": "210e8c0c-823f-4257-8bfe-3bc1e1778dad/data.json" }, { "name": "keysToExtract", "value": "[\n {\"resultIndex\": 0, \"key\": \".conforma.workerCount\", \"default\": \"4\"},\n {\"resultIndex\": 1, \"key\": \".sign.cosignSecretName\", \"default\": \"secret-not-present\"}\n]\n" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, { "name": "ociStorage", "value": "quay-service.quay/test-org/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:5472223c83e25c081093eff2a85162f866832d71352ce9c7a9de7d1da2b1df50" }, { "name": "trustedArtifactsDebug", "value": "" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, { "name": "pathInRepo", "value": "tasks/managed/collect-task-params/collect-task-params.yaml" } ], "resolver": "git" }, "timeout": "3h50m0s" }, "status": { "artifacts": {}, "completionTime": "2026-08-26T21:49:29Z", "conditions": [ { "lastTransitionTime": "2026-08-26T21:49:29Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-8cbr4-collect-task-params-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, "entryPoint": "tasks/managed/collect-task-params/collect-task-params.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "results": [ { "name": "extractedValues", "type": "array", "value": [ "4", "secret-not-present" ] } ], "startTime": "2026-08-26T21:49:19Z", "steps": [ { "container": "step-use-trusted-artifact", "imageID": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact", "provenance": {}, "terminated": { "containerID": "containerd://9093d8f1409e0201a18d303e07a7c3782326ffd5e9de83ee0fd88cf8a673bd88", "exitCode": 0, "finishedAt": "2026-08-26T21:49:25Z", "reason": "Completed", "startedAt": "2026-08-26T21:49:25Z" }, "terminationReason": "Completed" }, { "container": "step-collect-task-params", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "collect-task-params", "provenance": {}, "terminated": { "containerID": "containerd://f22d8eac8262dd57b94e82bcff832b4e3792ad8a0ea9502b838dc3d579ec43a0", "exitCode": 0, "finishedAt": "2026-08-26T21:49:25Z", "message": "[{\"key\":\"extractedValues\",\"value\":\"[\\n \\\"4\\\",\\n \\\"secret-not-present\\\"\\n]\\n\",\"type\":1}]", "reason": "Completed", "startedAt": "2026-08-26T21:49:25Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "Tekton task that extracts values from the data JSON file based on specified keys and exposes them as task results.\nThe task takes an array of resultIndex/key pairs and extracts the corresponding values from the dataPath JSON file.\nEach extracted value is placed at the specified resultIndex in the extractedValues array for use by downstream\ntasks. Optional default values can be provided for keys that may not exist in the data file. If no default is\nprovided and the key does not exist, the task will fail.", "params": [ { "description": "Path to the JSON string of the merged data containing the values to extract", "name": "dataPath", "type": "string" }, { "description": "JSON array of objects with \"resultIndex\", \"key\", and optional \"default\" fields. Each object specifies the array\nindex where the extracted value should be placed, the JSON path key to extract from the data file, and an\noptional default value to use if the key is not found. Example: [{\"resultIndex\": 1,\n\"key\": \".releaseNotes.summary\"}, {\"resultIndex\": 0, \"key\": \".foo\", \"default\": \"fallback_value\"}]\n", "name": "keysToExtract", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "", "description": "Location of trusted artifacts to be used to populate data directory", "name": "sourceDataArtifact", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "description": "The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" } ], "results": [ { "description": "Array of extracted values. Each value is placed at the resultIndex specified in the keysToExtract parameter.\nValues can be accessed by their specified index in downstream tasks.\n", "name": "extractedValues", "type": "array" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay-service.quay/test-org/trusted-artifacts@sha256:5472223c83e25c081093eff2a85162f866832d71352ce9c7a9de7d1da2b1df50=/var/workdir/release" ], "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "30m", "memory": "64Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "50m", "memory": "128Mi" } }, "env": [ { "name": "KEYS_JSON", "value": "[\n {\"resultIndex\": 0, \"key\": \".conforma.workerCount\", \"default\": \"4\"},\n {\"resultIndex\": 1, \"key\": \".sign.cosignSecretName\", \"default\": \"secret-not-present\"}\n]\n" } ], "image": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "collect-task-params", "script": "#!/usr/bin/env bash\nset -x\n\nDATA_FILE=\"/var/workdir/release/210e8c0c-823f-4257-8bfe-3bc1e1778dad/data.json\"\nif [ ! -f \"${DATA_FILE}\" ] ; then\n echo \"No valid data file was provided.\"\n exit 1\nfi\n\n# Validate KEYS_JSON format\nif ! jq -e 'type == \"array\"' \u003c\u003c\u003c \"$KEYS_JSON\" \u003e /dev/null; then\n echo \"keysToExtract must be a valid JSON array\"\n echo \"Received value: $KEYS_JSON\"\n exit 1\nfi\n\n# Get the number of keys to extract\nKEY_COUNT=$(jq 'length' \u003c\u003c\u003c \"$KEYS_JSON\")\nif [ \"$KEY_COUNT\" -eq 0 ]; then\n echo \"keysToExtract array is empty\"\n exit 1\nfi\n\n# Initialize result array with empty strings since it may not be populated in order based on\n# keysToExtract resultIndex input\nRESULT_ARRAY=\"[]\"\nfor i in $(seq 0 $((KEY_COUNT - 1))); do\n RESULT_ARRAY=$(jq '. += [\"\"]' \u003c\u003c\u003c \"$RESULT_ARRAY\")\ndone\n\nfor i in $(seq 0 $((KEY_COUNT - 1))); do\n RESULT_INDEX=$(jq -r \".[$i].resultIndex\" \u003c\u003c\u003c \"$KEYS_JSON\")\n KEY=$(jq -r \".[$i].key\" \u003c\u003c\u003c \"$KEYS_JSON\")\n DEFAULT_VALUE=$(jq -r \".[$i].default // null\" \u003c\u003c\u003c \"$KEYS_JSON\")\n\n if [ \"$RESULT_INDEX\" = \"null\" ] || [ \"$KEY\" = \"null\" ]; then\n echo \"Invalid key extraction specification at index $i: missing resultIndex or key\"\n exit 1\n fi\n\n # Check if resultIndex is a valid integer\n if ! [[ \"$RESULT_INDEX\" =~ ^[0-9]+$ ]]; then\n echo \"Error: resultIndex at position $i must be a non-negative integer, got: $RESULT_INDEX\"\n exit 1\n fi\n\n # Check if resultIndex is within valid bounds\n if [ \"$RESULT_INDEX\" -ge \"$KEY_COUNT\" ]; then\n echo \"Error: resultIndex $RESULT_INDEX at position $i is out of bounds.\"\n echo \"Valid range is 0 to $((KEY_COUNT - 1))\"\n exit 1\n fi\n\n # Extract the value from the data file using the specified key\n TRANSFORMED_KEY=$(echo \"$KEY\" | sed -E 's/\\.([^\\.\"\\[]+|\"[^\"]+\")/.\"\\1\"/g')\n VALUE=$(jq -r \"$TRANSFORMED_KEY\" \"$DATA_FILE\" 2\u003e/dev/null)\n\n # Check if the key exists in the data file\n if [ \"$VALUE\" = \"null\" ]; then\n if [ \"$DEFAULT_VALUE\" != \"null\" ]; then\n echo \"Key $KEY not found in data file, using default value: $DEFAULT_VALUE\"\n VALUE=\"$DEFAULT_VALUE\"\n else\n echo \"Error: Key $KEY not found in data file, and no default value for it was passed\"\n exit 1\n fi\n fi\n\n # Update the array at the specified resultIndex\n RESULT_ARRAY=$(jq --argjson idx \"$RESULT_INDEX\" --arg value \"$VALUE\" '.[$idx] = $value' \u003c\u003c\u003c \"$RESULT_ARRAY\")\ndone\n\n# Write the array result\njq \u003c\u003c\u003c \"$RESULT_ARRAY\" | tee \"/tekton/results/extractedValues\"\n" } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "operator-sdk/primary-resource": "ex-registry-sh-de10b91f/snapshot-sample-de10b91f-hwrzj", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "70f7308", "results.tekton.dev/record": "ex-registry-sh-managed-de10b91f/results/210e8c0c-823f-4257-8bfe-3bc1e1778dad/records/d54e1cd7-b56c-4aaa-9731-a93fd949dd97", "results.tekton.dev/result": "ex-registry-sh-managed-de10b91f/results/210e8c0c-823f-4257-8bfe-3bc1e1778dad", "results.tekton.dev/stored": "false", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-08-26T21:49:19Z", "finalizers": [ "chains.tekton.dev/taskrun", "results.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-de10b91f", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-de10b91f-hwrzj", "release.appstudio.openshift.io/namespace": "ex-registry-sh-de10b91f", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-8cbr4", "tekton.dev/pipelineRunUID": "210e8c0c-823f-4257-8bfe-3bc1e1778dad", "tekton.dev/pipelineTask": "reduce-snapshot", "tekton.dev/task": "reduce-snapshot" }, "name": "managed-8cbr4-reduce-snapshot", "namespace": "ex-registry-sh-managed-de10b91f", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-8cbr4", "uid": "210e8c0c-823f-4257-8bfe-3bc1e1778dad" } ], "resourceVersion": "9078", "uid": "d54e1cd7-b56c-4aaa-9731-a93fd949dd97" }, "spec": { "params": [ { "name": "SNAPSHOT", "value": "/var/workdir/release/210e8c0c-823f-4257-8bfe-3bc1e1778dad/snapshot_spec.json" }, { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "value": "snapshot/snapshot-sample-de10b91f" }, { "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "value": "ex-registry-sh-de10b91f" }, { "name": "SNAPSHOT_PATH", "value": "/var/workdir/release/210e8c0c-823f-4257-8bfe-3bc1e1778dad/snapshot_spec.json" }, { "name": "ociStorage", "value": "quay-service.quay/test-org/trusted-artifacts" }, { "name": "sourceDataArtifact", "value": "oci:quay-service.quay/test-org/trusted-artifacts@sha256:5472223c83e25c081093eff2a85162f866832d71352ce9c7a9de7d1da2b1df50" }, { "name": "dataDir", "value": "/var/workdir/release" }, { "name": "trustedArtifactsDebug", "value": "" }, { "name": "taskGitUrl", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "taskGitRevision", "value": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, { "name": "pathInRepo", "value": "tasks/managed/reduce-snapshot/reduce-snapshot.yaml" } ], "resolver": "git" }, "timeout": "3h50m0s" }, "status": { "conditions": [ { "lastTransitionTime": "2026-08-26T21:49:23Z", "message": "pod status \"Ready\":\"False\"; message: \"containers with unready status: [step-use-trusted-artifact step-reduce-snapshot step-create-trusted-artifact]\"", "reason": "Pending", "status": "Unknown", "type": "Succeeded" } ], "podName": "managed-8cbr4-reduce-snapshot-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, "entryPoint": "tasks/managed/reduce-snapshot/reduce-snapshot.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "startTime": "2026-08-26T21:49:19Z", "steps": [ { "container": "step-use-trusted-artifact", "name": "use-trusted-artifact", "provenance": {}, "waiting": { "reason": "PodInitializing" } }, { "container": "step-reduce-snapshot", "name": "reduce-snapshot", "provenance": {}, "waiting": { "reason": "PodInitializing" } }, { "container": "step-create-trusted-artifact", "name": "create-trusted-artifact", "provenance": {}, "waiting": { "reason": "PodInitializing" } } ], "taskSpec": { "description": "Tekton task to reduce a snapshot to a single component based on the component that the snapshot was built for.", "params": [ { "description": "String representation of Snapshot spec", "name": "SNAPSHOT", "type": "string" }, { "description": "Single mode component enabled", "name": "SINGLE_COMPONENT", "type": "string" }, { "description": "Custom Resource to query for built component in Snapshot", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE", "type": "string" }, { "default": "", "description": "Namespace where Custom Resource is found", "name": "SINGLE_COMPONENT_CUSTOM_RESOURCE_NS", "type": "string" }, { "description": "The location to place the reduced Snapshot", "name": "SNAPSHOT_PATH", "type": "string" }, { "default": "empty", "description": "The OCI repository where the Trusted Artifacts are stored", "name": "ociStorage", "type": "string" }, { "default": "1d", "description": "Expiration date for the trusted artifacts created in the OCI repository. An empty string means the artifacts do not expire", "name": "ociArtifactExpiresAfter", "type": "string" }, { "default": "", "description": "Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable", "name": "trustedArtifactsDebug", "type": "string" }, { "default": "", "description": "oras options to pass to Trusted Artifacts calls", "name": "orasOptions", "type": "string" }, { "default": "", "description": "Location of trusted artifacts to be used to populate data directory", "name": "sourceDataArtifact", "type": "string" }, { "default": "/var/workdir/release", "description": "The location where data will be stored", "name": "dataDir", "type": "string" }, { "description": "The url to the git repo where the release-service-catalog tasks and stepactions to be used are stored", "name": "taskGitUrl", "type": "string" }, { "description": "The revision in the taskGitUrl repo to be used", "name": "taskGitRevision", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" }, { "default": "/mnt/trusted-ca/ca-bundle.crt", "description": "Path to CA certificate bundle for TLS verification with self-signed certificates", "name": "caCertPath", "type": "string" } ], "results": [ { "description": "Produced trusted data artifact", "name": "sourceDataArtifact", "type": "string" } ], "stepTemplate": { "computeResources": {}, "env": [ { "name": "IMAGE_EXPIRES_AFTER", "value": "1d" }, { "name": "ORAS_OPTIONS" }, { "name": "DEBUG" } ], "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/var/workdir", "name": "workdir" }, { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "args": [ "use", "oci:quay-service.quay/test-org/trusted-artifacts@sha256:5472223c83e25c081093eff2a85162f866832d71352ce9c7a9de7d1da2b1df50=/var/workdir/release" ], "computeResources": { "limits": { "memory": "64Mi" }, "requests": { "cpu": "30m", "memory": "64Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "use-trusted-artifact" }, { "command": [ "python3", "-m", "reduce_snapshot" ], "computeResources": { "limits": { "memory": "256Mi" }, "requests": { "cpu": "50m", "memory": "256Mi" } }, "env": [ { "name": "SINGLE_COMPONENT", "value": "false" }, { "name": "CUSTOM_RESOURCE", "value": "snapshot/snapshot-sample-de10b91f" }, { "name": "CUSTOM_RESOURCE_NAMESPACE", "value": "ex-registry-sh-de10b91f" }, { "name": "SNAPSHOT", "value": "/var/workdir/release/210e8c0c-823f-4257-8bfe-3bc1e1778dad/snapshot_spec.json" }, { "name": "SNAPSHOT_PATH", "value": "/var/workdir/release/210e8c0c-823f-4257-8bfe-3bc1e1778dad/snapshot_spec.json" } ], "image": "quay.io/konflux-ci/release-service-utils@sha256:52e87af53ca4c537894af6e4c228dd471f475de217fbd13b7cc1ce6747c37aed", "name": "reduce-snapshot" }, { "args": [ "create", "--store", "quay-service.quay/test-org/trusted-artifacts", "/tekton/results/sourceDataArtifact=/var/workdir/release" ], "computeResources": { "limits": { "memory": "128Mi" }, "requests": { "cpu": "250m", "memory": "128Mi" } }, "env": [ { "name": "HOME", "value": "/tekton/home" }, { "name": "ORAS_OPTIONS" }, { "name": "CA_FILE", "value": "/mnt/trusted-ca/ca-bundle.crt" } ], "image": "quay.io/konflux-ci/build-trusted-artifacts@sha256:9bd32f6bafb517b309e11a2d89365052b4ab3f1c9c23c4ffd45aff6f03960476", "name": "create-trusted-artifact" } ], "volumes": [ { "emptyDir": {}, "name": "workdir" }, { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } }, { "apiVersion": "tekton.dev/v1", "kind": "TaskRun", "metadata": { "annotations": { "chains.tekton.dev/signed": "true", "operator-sdk/primary-resource": "ex-registry-sh-de10b91f/snapshot-sample-de10b91f-hwrzj", "operator-sdk/primary-resource-type": "Release.appstudio.redhat.com", "pipeline.tekton.dev/release": "70f7308", "results.tekton.dev/childReadyForDeletion": "true", "results.tekton.dev/record": "ex-registry-sh-managed-de10b91f/results/210e8c0c-823f-4257-8bfe-3bc1e1778dad/records/209735c9-26ac-47cc-9d46-f80510809078", "results.tekton.dev/result": "ex-registry-sh-managed-de10b91f/results/210e8c0c-823f-4257-8bfe-3bc1e1778dad", "results.tekton.dev/stored": "true", "tekton.dev/pipelines.minVersion": "0.12.1", "tekton.dev/tags": "release" }, "creationTimestamp": "2026-08-26T21:48:09Z", "finalizers": [ "results.tekton.dev/taskrun", "chains.tekton.dev/taskrun" ], "generation": 1, "labels": { "app.kubernetes.io/managed-by": "tekton-pipelines", "appstudio.openshift.io/application": "appstudio", "appstudio.openshift.io/service": "release", "appstudio.openshift.io/snapshot": "snapshot-sample-de10b91f", "pipelines.appstudio.openshift.io/type": "managed", "release.appstudio.openshift.io/attempt": "0", "release.appstudio.openshift.io/name": "snapshot-sample-de10b91f-hwrzj", "release.appstudio.openshift.io/namespace": "ex-registry-sh-de10b91f", "tekton.dev/memberOf": "tasks", "tekton.dev/pipeline": "push-to-external-registry", "tekton.dev/pipelineRun": "managed-8cbr4", "tekton.dev/pipelineRunUID": "210e8c0c-823f-4257-8bfe-3bc1e1778dad", "tekton.dev/pipelineTask": "verify-access-to-resources", "tekton.dev/task": "verify-access-to-resources" }, "name": "managed-8cbr4-verify-access-to-resources", "namespace": "ex-registry-sh-managed-de10b91f", "ownerReferences": [ { "apiVersion": "tekton.dev/v1", "blockOwnerDeletion": true, "controller": true, "kind": "PipelineRun", "name": "managed-8cbr4", "uid": "210e8c0c-823f-4257-8bfe-3bc1e1778dad" } ], "resourceVersion": "8513", "uid": "209735c9-26ac-47cc-9d46-f80510809078" }, "spec": { "params": [ { "name": "release", "value": "ex-registry-sh-de10b91f/snapshot-sample-de10b91f-hwrzj" }, { "name": "releasePlan", "value": "ex-registry-sh-de10b91f/source-releaseplan" }, { "name": "releasePlanAdmission", "value": "ex-registry-sh-managed-de10b91f/demo" }, { "name": "releaseServiceConfig", "value": "release-service/release-service-config" }, { "name": "snapshot", "value": "ex-registry-sh-de10b91f/snapshot-sample-de10b91f" }, { "name": "requireInternalServices", "value": "false" } ], "serviceAccountName": "release-service-account", "taskRef": { "params": [ { "name": "url", "value": "https://github.com/konflux-ci/release-service-catalog" }, { "name": "revision", "value": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, { "name": "pathInRepo", "value": "tasks/managed/verify-access-to-resources/verify-access-to-resources.yaml" } ], "resolver": "git" }, "timeout": "3h50m0s" }, "status": { "artifacts": {}, "completionTime": "2026-08-26T21:48:44Z", "conditions": [ { "lastTransitionTime": "2026-08-26T21:48:44Z", "message": "All Steps have completed executing", "reason": "Succeeded", "status": "True", "type": "Succeeded" } ], "podName": "managed-8cbr4-verify-access-to-resources-pod", "provenance": { "featureFlags": { "awaitSidecarReadiness": true, "coschedule": "workspaces", "enableAPIFields": "beta", "enableProvenanceInStatus": true, "enforceNonfalsifiability": "none", "maxResultSize": 4096, "resultExtractionMethod": "termination-message", "runningInEnvWithInjectedSidecars": true, "sendCloudEventsForRuns": true, "verificationNoMatchPolicy": "ignore" }, "refSource": { "digest": { "sha1": "af03de6a3bdb8dfaba653846f8a50b23bc97d0aa" }, "entryPoint": "tasks/managed/verify-access-to-resources/verify-access-to-resources.yaml", "uri": "git+https://github.com/konflux-ci/release-service-catalog" } }, "startTime": "2026-08-26T21:48:09Z", "steps": [ { "container": "step-verify-access-to-resources", "imageID": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "verify-access-to-resources", "provenance": {}, "terminated": { "containerID": "containerd://417b812b3a31777b76a986ad80908ca1cad5e93a4aac3a9f677948ecc1ce4afa", "exitCode": 0, "finishedAt": "2026-08-26T21:48:39Z", "reason": "Completed", "startedAt": "2026-08-26T21:48:39Z" }, "terminationReason": "Completed" } ], "taskSpec": { "description": "This Tekton task is used to verify access to various resources in the pipelines. It ensures that the necessary\nresources, such as the release, release plan, release plan admission, release service config and snapshot,\nare available and accessible. Additionally, it checks if internal requests can be created if\n`requireInternalServices` is set to `true`.", "params": [ { "description": "Namespace/name of the Release", "name": "release", "type": "string" }, { "description": "Namespace/name of the ReleasePlan", "name": "releasePlan", "type": "string" }, { "description": "Namespace/name of the ReleasePlanAdmission", "name": "releasePlanAdmission", "type": "string" }, { "description": "Namespace/name of the ReleaseServiceConfig", "name": "releaseServiceConfig", "type": "string" }, { "description": "Namespace/name of the Snapshot", "name": "snapshot", "type": "string" }, { "default": "false", "description": "Whether internal services are required", "name": "requireInternalServices", "type": "string" }, { "default": "trusted-ca", "description": "The name of the ConfigMap to read CA bundle data from", "name": "caTrustConfigMapName", "type": "string" }, { "default": "ca-bundle.crt", "description": "The name of the key in the ConfigMap that contains the CA bundle data", "name": "caTrustConfigMapKey", "type": "string" } ], "stepTemplate": { "computeResources": {}, "securityContext": { "runAsUser": 1001 }, "volumeMounts": [ { "mountPath": "/mnt/trusted-ca", "name": "trusted-ca", "readOnly": true } ] }, "steps": [ { "computeResources": { "limits": { "memory": "100Mi" }, "requests": { "cpu": "10m", "memory": "100Mi" } }, "image": "quay.io/konflux-ci/release-service-utils@sha256:5546fa78d3c88d7b6a2e8cff8902f7757f00541d0bbaf113b9f293133894afa3", "name": "verify-access-to-resources", "script": "#!/usr/bin/env bash\n\nORIGIN_NAMESPACE=\"$(cut -f1 -d/ \u003c\u003c\u003c \"ex-registry-sh-de10b91f/snapshot-sample-de10b91f-hwrzj\")\"\nTARGET_NAMESPACE=\"$(cut -f1 -d/ \u003c\u003c\u003c \"ex-registry-sh-managed-de10b91f/demo\")\"\nRSC_NAMESPACE=\"$(cut -f1 -d/ \u003c\u003c\u003c \"release-service/release-service-config\")\"\n\nRELEASE_NAME=\"$(cut -f2 -d/ \u003c\u003c\u003c \"ex-registry-sh-de10b91f/snapshot-sample-de10b91f-hwrzj\")\"\nRELEASEPLAN_NAME=\"$(cut -f2 -d/ \u003c\u003c\u003c \"ex-registry-sh-de10b91f/source-releaseplan\")\"\nRELEASEPLANADMISSION_NAME=\"$(cut -f2 -d/ \u003c\u003c\u003c \"ex-registry-sh-managed-de10b91f/demo\")\"\nRELEASESERVICECONFIG_NAME=\"$(cut -f2 -d/ \u003c\u003c\u003c \"release-service/release-service-config\")\"\nSNAPSHOT_NAME=\"$(cut -f2 -d/ \u003c\u003c\u003c \"ex-registry-sh-de10b91f/snapshot-sample-de10b91f\")\"\n\nCAN_I_READ_RELEASES=\"$(kubectl auth can-i get release/\"${RELEASE_NAME}\" -n \"${ORIGIN_NAMESPACE}\")\"\nCAN_I_READ_RELEASEPLANS=\"$(kubectl auth can-i get releaseplan/\"${RELEASEPLAN_NAME}\"\\\n -n \"${ORIGIN_NAMESPACE}\")\"\nCAN_I_READ_RELEASEPLANADMISSIONS=\"$(kubectl auth can-i get\\\n releaseplanadmission/\"${RELEASEPLANADMISSION_NAME}\" -n \"${TARGET_NAMESPACE}\")\"\nCAN_I_READ_RELEASESERVICECONFIG=\"$(kubectl auth can-i get\\\n releaseserviceconfig/\"${RELEASESERVICECONFIG_NAME}\" -n \"${RSC_NAMESPACE}\")\"\nCAN_I_READ_SNAPSHOTS=\"$(kubectl auth can-i get snapshot/\"${SNAPSHOT_NAME}\" -n \"${ORIGIN_NAMESPACE}\")\"\n\nif [ \"false\" = \"true\" ]; then\n CAN_I_CREATE_INTERNALREQUESTS=\"$(kubectl auth can-i create internalrequest -n \"${TARGET_NAMESPACE}\")\"\nelse\n CAN_I_CREATE_INTERNALREQUESTS=\"skipped\"\nfi\n\necho \"\"\necho \"CAN_I_READ_RELEASES? ${CAN_I_READ_RELEASES}\"\necho \"CAN_I_READ_RELEASEPLANS? ${CAN_I_READ_RELEASEPLANS}\"\necho \"CAN_I_READ_RELEASEPLANADMISSIONS? ${CAN_I_READ_RELEASEPLANADMISSIONS}\"\necho \"CAN_I_READ_RELEASESERVICECONFIG? ${CAN_I_READ_RELEASESERVICECONFIG}\"\necho \"CAN_I_READ_SNAPSHOTS? ${CAN_I_READ_SNAPSHOTS}\"\necho \"\"\necho \"CAN_I_CREATE_INTERNALREQUESTS? ${CAN_I_CREATE_INTERNALREQUESTS}\"\necho \"\"\n\nif [ \"${CAN_I_READ_RELEASES}\" = \"no\" ] ||\\\n [ \"${CAN_I_READ_RELEASEPLANS}\" = \"no\" ] ||\\\n [ \"${CAN_I_READ_RELEASEPLANADMISSIONS}\" = \"no\" ] ||\\\n [ \"${CAN_I_READ_RELEASESERVICECONFIG}\" = \"no\" ] ||\\\n [ \"${CAN_I_READ_SNAPSHOTS}\" = \"no\" ] ||\\\n [ \"${CAN_I_CREATE_INTERNALREQUESTS}\" = \"no\" ] ; then\n echo \"Error: Cannot read or create required Release resources!\"\n echo \"\"\n echo \"This indicates that your workspace is not correctly setup\"\n echo \"Please reach out to a workspace administrator\"\n exit 1\nfi\n\necho \"Access to Release resources verified\"\n" } ], "volumes": [ { "configMap": { "items": [ { "key": "ca-bundle.crt", "path": "ca-bundle.crt" } ], "name": "trusted-ca", "optional": true }, "name": "trusted-ca" } ] } } } ], "kind": "List", "metadata": { "resourceVersion": "" } }