Repository: tektoncd/operator
Pull request #1194 (2022-11-28 12:35:26)

Adds `resource-verification-mode` and `enable-provenance-in-status`  fields for Pipelines
# Changes

- This adds a new field in TektonPipeline to alter value for new field
in `feature-flag` configmap.

  - Fields:
    - resource-verification-mode (Default: "skip")
    - enable-provenance-in-status (Default: false)

Signed-off-by: Puneet Punamiya ppunamiy@redhat.com



<!-- 🎉🎉🎉 Thank you for the PR!!! 🎉🎉🎉 -->

<!-- Describe your changes here- ideally you can get that description straight from
your descriptive commit message(s)! -->

# Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

- [ ] Run `make test lint` before submitting a PR
- [ ] Includes [tests](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if functionality changed/added)
- [ ] Includes [docs](https://github.com/tektoncd/community/blob/master/standards.md#principles) (if user facing)
- [ ] Commit messages follow [commit message best practices](https://github.com/tektoncd/community/blob/master/standards.md#commit-messages)

_See [the contribution guide](https://github.com/tektoncd/operator/blob/master/CONTRIBUTING.md) for more details._

# Release Notes

<!--
Describe any user facing changes here, or delete this block.

Examples of user facing changes:
- API changes
- Bug fixes
- Any changes in behavior
- Changes requiring upgrade notices or deprecation warnings

For pull requests with a release note:

```release-note
Your release note here
```

For pull requests that require additional action from users switching to the new release, include the string "action required" (case insensitive) in the release note:

```release-note
action required: your release note here
```

For pull requests that don't need to be mentioned at release time, use the `/release-note-none` Prow command to add the `release-note-none` label to the PR. You can also write the string "NONE" as a release note in your PR description:

```release-note
NONE
```
-->


tekton-robot: [APPROVALNOTIFIER] This PR is **NOT APPROVED**

This pull-request has been approved by:
To complete the [pull request process](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process), please assign **concaf** after the PR has been reviewed.
You can assign the PR to them by writing `/assign @concaf` in a comment when ready.

The full list of commands accepted by this bot can be found [here](https://prow.tekton.dev/command-help?repo=tektoncd%2Foperator).

<details open>
Needs approval from an approver in each of these files:

- **[OWNERS](https://github.com/tektoncd/operator/blob/main/OWNERS)**

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":["concaf"]} -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/apis/operator/v1alpha1/tektonpipeline_defaults.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1194/pull-tekton-operator-go-coverage/1597207543640231936/artifacts/line-cov.html#file0) | 90.2% | 90.9% | 0.7
[pkg/apis/operator/v1alpha1/tektonpipeline_validation.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1194/pull-tekton-operator-go-coverage/1597207543640231936/artifacts/line-cov.html#file2) | 66.7% | 61.9% | -4.8

tekton-robot: @PuneetPunamiya: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-tekton-operator-unit-tests | 7eca9efa299b2f7dcd25c3136978144fa1c652f1 | [link](https://prow.tekton.dev/view/gs/tekton-prow/pr-logs/pull/tektoncd_operator/1194/pull-tekton-operator-unit-tests/1597207543547957248) | true | `/test pull-tekton-operator-unit-tests`

[Full PR test history](https://prow.tekton.dev/pr-history?org=tektoncd&repo=operator&pr=1194). [Your PR dashboard](https://prow.tekton.dev/pr?query=is%3Apr%20state%3Aopen%20author%3APuneetPunamiya).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/apis/operator/v1alpha1/tektonpipeline_defaults.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1194/pull-tekton-operator-go-coverage/1597220715667394560/artifacts/line-cov.html#file0) | 90.2% | 90.9% | 0.7
[pkg/apis/operator/v1alpha1/tektonpipeline_validation.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1194/pull-tekton-operator-go-coverage/1597220715667394560/artifacts/line-cov.html#file2) | 66.7% | 61.9% | -4.8

tekton-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/tektoncd/operator/pull/1194#pullrequestreview-1195856974" title="Approved">vdemeester</a>*

The full list of commands accepted by this bot can be found [here](https://prow.tekton.dev/command-help?repo=tektoncd%2Foperator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/tektoncd/operator/blob/main/OWNERS)~~ [vdemeester]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/apis/operator/v1alpha1/tektonpipeline_defaults.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1194/pull-tekton-operator-go-coverage/1597240823185936384/artifacts/line-cov.html#file0) | 90.2% | 90.9% | 0.7
[pkg/apis/operator/v1alpha1/tektonpipeline_validation.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1194/pull-tekton-operator-go-coverage/1597240823185936384/artifacts/line-cov.html#file2) | 66.7% | 61.9% | -4.8

tekton-robot: @PuneetPunamiya: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-tekton-operator-integration-tests | 00b44065657772bb4c3a1265b19de6428e2e6dbb | [link](https://prow.tekton.dev/view/gs/tekton-prow/pr-logs/pull/tektoncd_operator/1194/pull-tekton-operator-integration-tests/1597240823215296512) | true | `/test pull-tekton-operator-integration-tests`

[Full PR test history](https://prow.tekton.dev/pr-history?org=tektoncd&repo=operator&pr=1194). [Your PR dashboard](https://prow.tekton.dev/pr?query=is%3Apr%20state%3Aopen%20author%3APuneetPunamiya).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
PuneetPunamiya: /test pull-tekton-operator-integration-tests
tekton-robot: New changes are detected. LGTM label has been removed.
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/apis/operator/v1alpha1/tektonpipeline_defaults.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1194/pull-tekton-operator-go-coverage/1597453957549002752/artifacts/line-cov.html#file0) | 90.2% | 90.9% | 0.7
[pkg/apis/operator/v1alpha1/tektonpipeline_validation.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1194/pull-tekton-operator-go-coverage/1597453957549002752/artifacts/line-cov.html#file2) | 66.7% | 61.9% | -4.8

tekton-robot: @PuneetPunamiya: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
pull-tekton-operator-integration-tests | 1a7778baf7db39a0cdfc42ade0d7640019281e63 | [link](https://prow.tekton.dev/view/gs/tekton-prow/pr-logs/pull/tektoncd_operator/1194/pull-tekton-operator-integration-tests/1597453957569974272) | true | `/test pull-tekton-operator-integration-tests`

[Full PR test history](https://prow.tekton.dev/pr-history?org=tektoncd&repo=operator&pr=1194). [Your PR dashboard](https://prow.tekton.dev/pr?query=is%3Apr%20state%3Aopen%20author%3APuneetPunamiya).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/apis/operator/v1alpha1/tektonpipeline_defaults.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1194/pull-tekton-operator-go-coverage/1597488138874261504/artifacts/line-cov.html#file0) | 90.2% | 90.9% | 0.7
[pkg/apis/operator/v1alpha1/tektonpipeline_validation.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1194/pull-tekton-operator-go-coverage/1597488138874261504/artifacts/line-cov.html#file2) | 66.7% | 61.9% | -4.8

tekton-robot: The following is the coverage report on the affected files.
Say `/test pull-tekton-operator-go-coverage` to re-run this coverage report

File | Old Coverage | New Coverage | Delta
---- |:------------:|:------------:|:-----:
[pkg/apis/operator/v1alpha1/tektonpipeline_defaults.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1194/pull-tekton-operator-go-coverage/1597502115498954752/artifacts/line-cov.html#file0) | 90.2% | 90.9% | 0.7
[pkg/apis/operator/v1alpha1/tektonpipeline_validation.go](https://storage.cloud.google.com/tekton-prow/pr-logs/pull/tektoncd_operator/1194/pull-tekton-operator-go-coverage/1597502115498954752/artifacts/line-cov.html#file2) | 66.7% | 61.9% | -4.8


Patch:
diff --git a/pkg/apis/operator/v1alpha1/tektonpipeline_defaults.go b/pkg/apis/operator/v1alpha1/tektonpipeline_defaults.go
index 093ea582a..b87419f22 100644
--- a/pkg/apis/operator/v1alpha1/tektonpipeline_defaults.go
+++ b/pkg/apis/operator/v1alpha1/tektonpipeline_defaults.go
@@ -63,6 +63,12 @@ func (p *Pipeline) setDefaults() {
 	if p.EmbeddedStatus == "" {
 		p.EmbeddedStatus = config.DefaultEmbeddedStatus
 	}
+	if p.VerificationMode == "" {
+		p.VerificationMode = config.DefaultResourceVerificationMode
+	}
+	if p.EnableProvenanceInStatus == nil {
+		p.EnableProvenanceInStatus = ptr.Bool(config.DefaultEnableProvenanceInStatus)
+	}
 
 	// Deprecated: set to nil, remove in further release
 	p.ScopeWhenExpressionsToTask = nil
diff --git a/pkg/apis/operator/v1alpha1/tektonpipeline_types.go b/pkg/apis/operator/v1alpha1/tektonpipeline_types.go
index 8bc0cf3e6..3c92c0b05 100644
--- a/pkg/apis/operator/v1alpha1/tektonpipeline_types.go
+++ b/pkg/apis/operator/v1alpha1/tektonpipeline_types.go
@@ -95,6 +95,8 @@ type PipelineProperties struct {
 	EnableApiFields                          string `json:"enable-api-fields,omitempty"`
 	EmbeddedStatus                           string `json:"embedded-status,omitempty"`
 	SendCloudEventsForRuns                   *bool  `json:"send-cloudevents-for-runs,omitempty"`
+	VerificationMode                         string `json:"verification-mode,omitempty"`
+	EnableProvenanceInStatus                 *bool  `json:"enable-provenance-in-status,omitempty"`
 
 	// ScopeWhenExpressionsToTask Deprecated: remove in next release
 	ScopeWhenExpressionsToTask *bool `json:"scope-when-expressions-to-task,omitempty"`
diff --git a/pkg/apis/operator/v1alpha1/tektonpipeline_validation.go b/pkg/apis/operator/v1alpha1/tektonpipeline_validation.go
index b8f79dda5..589fac333 100644
--- a/pkg/apis/operator/v1alpha1/tektonpipeline_validation.go
+++ b/pkg/apis/operator/v1alpha1/tektonpipeline_validation.go
@@ -60,5 +60,12 @@ func (p *PipelineProperties) validate(path string) (errs *apis.FieldError) {
 			errs = errs.Also(apis.ErrInvalidValue(p.EmbeddedStatus, path+".embedded-status"))
 		}
 	}
+
+	if p.VerificationMode != "" {
+		if p.VerificationMode != config.SkipResourceVerificationMode && p.VerificationMode != config.WarnResourceVerificationMode && p.VerificationMode != config.EnforceResourceVerificationMode {
+			errs = errs.Also(apis.ErrInvalidValue(p.VerificationMode, path+".verification-mode"))
+		}
+	}
+
 	return errs
 }
diff --git a/pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go
index 90d81e1a5..a691b31be 100644
--- a/pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go
+++ b/pkg/apis/operator/v1alpha1/zz_generated.deepcopy.go
@@ -565,6 +565,11 @@ func (in *PipelineProperties) DeepCopyInto(out *PipelineProperties) {
 		*out = new(bool)
 		**out = **in
 	}
+	if in.EnableProvenanceInStatus != nil {
+		in, out := &in.EnableProvenanceInStatus, &out.EnableProvenanceInStatus
+		*out = new(bool)
+		**out = **in
+	}
 	if in.ScopeWhenExpressionsToTask != nil {
 		in, out := &in.ScopeWhenExpressionsToTask, &out.ScopeWhenExpressionsToTask
 		*out = new(bool)


Test patch:
diff --git a/pkg/apis/operator/v1alpha1/tektonpipeline_defaults_test.go b/pkg/apis/operator/v1alpha1/tektonpipeline_defaults_test.go
index d5eeec86e..fb909335f 100644
--- a/pkg/apis/operator/v1alpha1/tektonpipeline_defaults_test.go
+++ b/pkg/apis/operator/v1alpha1/tektonpipeline_defaults_test.go
@@ -51,6 +51,8 @@ func Test_SetDefaults_PipelineProperties(t *testing.T) {
 		EmbeddedStatus:                           "full",
 		ScopeWhenExpressionsToTask:               nil,
 		SendCloudEventsForRuns:                   ptr.Bool(false),
+		VerificationMode:                         "skip",
+		EnableProvenanceInStatus:                 ptr.Bool(false),
 		PipelineMetricsProperties: PipelineMetricsProperties{
 			MetricsPipelinerunDurationType: "histogram",
 			MetricsPipelinerunLevel:        "pipeline",