task: Add M2M support for rhacs-image-scan

[dhaus67]

Changes

Add a new version of the rhacs-image-scan task that can be configured either with authorization using API tokens (similar configuration to 3.71 version of the task), or with authorization using short-lived tokens received from the new rhacs-m2m-authenticate task.

Both configuration variants have a sample with the expected Secret, Pipeline and PipelineRun objects.

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you review them:

• [x] Follows the authoring recommendations
• [x] Includes docs (if user facing)
• [ ] Includes tests (for new tasks or changed functionality)
  • See the end-to-end testing documentation for guidance and CI details.
• [x] Meets the Tekton contributor standards (including functionality, content, code)
• [x] Commit messages follow commit message best practices
• [x] Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
• [x] Complies with Catalog Organization TEP, see example. Note An issue has been filed to automate this validation

  • [x] File path follows <kind>/<name>/<version>/name.yaml

  • [x] Has README.md at <kind>/<name>/<version>/README.md

  • [x] Has mandatory metadata.labels - app.kubernetes.io/version the same as the <version> of the resource

  • [x] Has mandatory metadata.annotations tekton.dev/pipelines.minVersion

  • [x] mandatory spec.description follows the convention

      ```
    
      spec:
        description: >-
          one line summary of the resource
    
          Paragraph(s) to describe the resource.
      ```
    

See the contribution guide for more details.

[linux-foundation-easycla[bot]]

The committers listed above are authorized under a signed CLA.

• :white_check_mark: login: dhaus67 (2b14ea8fe73f66cd87cdebd962219719d93ce63d)

[tekton-robot]

Hi @dhaus67. Thanks for your PR.

I'm waiting for a tektoncd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[tekton-robot]

Diff between version and 4.0

diff --git a/task/rhacs-image-scan/3.71/README.md b/task/rhacs-image-scan/3.71/README.md
deleted file mode 100644
index 2d16c66..0000000
--- a/task/rhacs-image-scan/3.71/README.md
+++ /dev/null
@@ -1,72 +0,0 @@
-# Red Hat Advanced Cluster Security Image Scan Task
-
-Scan an image for vulnerabilities and metadata against RHACS build and deploy lifecycle policies to validate a pipeline run using `roxctl`.
-
-This tasks allows you to return full vulnerability scan results for an image in JSON, CSV, or Pretty format.  It's a companion to the rhacs-image-check task.
-
-## Prerequisites
-
-This task requires an active installation of [Red Hat Advanced Cluster Security (RHACS)](https://www.redhat.com/en/resources/advanced-cluster-security-for-kubernetes-datasheet) or [StackRox](https://www.stackrox.io/).  It also requires configuration of secrets for the Central endpoint and an API token with at least CI privileges.
-
-## Install the Task
-
-```bash
-kubectl apply -f https://api.hub.tekton.dev/v1/resource/tekton/task/rhacs-image-scan/3.71/raw
-```
-
-## Parameters
-
-- **`image`**: Full name of image to scan. Examples: _gcr.io/rox/sample:5.0-rc1, **$(params.IMAGE)**, $(params.IMAGE)@$(tasks.buildah.results.IMAGE_DIGEST)_
-- **`insecure-skip-tls-verify`**: Skip verification the TLS certs for Central endpoint and registry. Examples: _"true", **"false"**_.
-- **`output_format`**:  Examples: _**json**, csv, pretty_
-- **`rox_central_endpoint`**: Secret containing the address:port tuple for StackRox Central. Default: _**rox-central-endpoint**_
-- **`rox_api_token`**: Secret containing the StackRox API token with CI permissions. Default: _**rox-api-token**_
-
-## Usage
-
-Scans images that have been pushed to a registry.  This enables scanning regardless of whether the build is using traditional Docker-based approaches, hosted/SaaS-based approaches where the Docker socket may not be directly available, or rootless approaches like `kaniko` and `buildah`.
-
-If the image violates one or more enforced policies, this task will return a failure and cause the pipeline run to fail.
-
-**Example secret creation:**
-
-```bash
-kubectl create secret generic rox-api-token \
-  --from-literal=rox_api_token="$ROX_API_TOKEN"
-kubectl create secret generic rox-central-endpoint \
-  --from-literal=rox_central_endpoint=central.stackrox.svc:443
-```
-
-**Example task use:**
-
-```yaml
-  tasks:
-    - name: image-scan
-      taskRef:
-        name: rhacs-image-scan
-        kind: Task
-        params:
-          - name: image
-            value: "$(params.IMAGE)@$(tasks.build-image.results.IMAGE_DIGEST)"
-      runAfter:
-      - build-image
-```
-
-**Samples:**
-
-- [secrets.yaml](samples/secrets.yaml) example secret
-- [pipeline.yaml](samples/pipeline.yaml) demonstrates use in a pipeline.
-- [pipelinerun.yaml](samples/pipelinerun.yaml) demonstrates use in a pipelinerun.
-
-# Known Issues
-
-* Skipping TLS Verify is currently required. TLS trust bundle not working for quay.io etc.
-* Saving scan output as a 'result' does not work, because it is often larger than 4KB. This also would require container invocation via script.
-
-  ```
-  STEP-ROX-IMAGE-SCAN
-
-  {"level":"fatal","ts":1659318163.069173,"caller":"entrypoint/entrypointer.go:188","msg":"Error while handling results: Termination message is above max allowed size 4096, caused by large task result.","stacktrace":"github.com/tektoncd/pipeline/pkg/entrypoint.Entrypointer.Go\n\t/opt/app-root/src/go/src/github.com/tektoncd/pipeline/pkg/entrypoint/entrypointer.go:188\nmain.main\n\t/opt/app-root/src/go/src/github.com/tektoncd/pipeline/cmd/entrypoint/main.go:154\nruntime.main\n\t/usr/lib/golang/src/runtime/proc.go:225"}
-  ```
-
-* Version of roxctl should maintain compatibility with Central API. Maximum allowable version drift is unknown.
\ No newline at end of file
diff --git a/task/rhacs-image-scan/3.71/rhacs-image-scan.yaml b/task/rhacs-image-scan/3.71/rhacs-image-scan.yaml
deleted file mode 100644
index a089890..0000000
--- a/task/rhacs-image-scan/3.71/rhacs-image-scan.yaml
+++ /dev/null
@@ -1,80 +0,0 @@
----
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: rhacs-image-scan
-  labels:
-    app.kubernetes.io/version: "3.71"
-  annotations:
-    tekton.dev/tags: security
-    tekton.dev/categories: Security
-    tekton.dev/displayName: "Scan an image for vulnerabilities with Red Hat Advanced Cluster Security"
-    tekton.dev/platforms: "linux/amd64"
-    tekton.dev/pipelines.minVersion: "0.18.0"
-spec:
-  description: >-
-    Scan an image with Red Hat Advanced Cluster Security.
-
-    This task allows you to return full vulnerability scan results for an image
-    in CSV, Table, or JSON formats.
-    The companion rhacs-image-check task checks an image against build-time policies.
-  params:
-    - name: rox_central_endpoint
-      type: string
-      description: Name of secret containing the address:port tuple for RHACS Stackrox Central.
-      default: rox-central-endpoint
-    - name: rox_api_token
-      type: string
-      description: Name of secret containing the RHACS StackRox API token with CI permissions.
-      default: rox-api-token
-    - name: rox_image
-      description: Image providing the roxctl tool.
-      default: quay.io/stackrox-io/roxctl:3.71.0
-    - name: image
-      type: string
-      description: |
-        Full name of image to scan.
-
-        SHA 256 digest may be included to ensure scan of sequental runs with same tag.
-        Examples: 'gcr.io/rox/sample:5.0-rc1', '$(params.IMAGE)', '$(params.IMAGE)@$(tasks.buildah.results.IMAGE_DIGEST)'
-      default: '$(params.IMAGE)'
-    - name: output_format
-      type: string
-      description: Results output format (json | csv | table)
-      default: json
-    - name: insecure-skip-tls-verify
-      type: string
-      description: |
-        Do not verify TLS certificates.
-
-        When set to "true", skip verifying the TLS certs of the Central endpoint and registry.
-      default: "false"
-  steps:
-    - name: rox-image-scan
-      image: $(params.rox_image)
-      env:
-        - name: HOME
-          value: /tekton/home
-        - name: IMAGE
-          value: $(params.image)
-        - name: INSECURE
-          value: $(params.insecure-skip-tls-verify)
-        - name: OUTPUT
-          value: $(params.output_format)
-        - name: ROX_API_TOKEN
-          valueFrom:
-            secretKeyRef:
-              name: $(params.rox_api_token)
-              key: rox_api_token
-        - name: ROX_CENTRAL_ENDPOINT
-          valueFrom:
-            secretKeyRef:
-              name: $(params.rox_central_endpoint)
-              key: rox_central_endpoint
-      args:
-        - image
-        - scan
-        - --endpoint=$(ROX_CENTRAL_ENDPOINT)
-        - --insecure-skip-tls-verify=$(INSECURE)
-        - --output=$(OUTPUT)
-        - --image=$(IMAGE)
diff --git a/task/rhacs-image-scan/3.71/samples/pipeline.yaml b/task/rhacs-image-scan/3.71/samples/pipeline.yaml
deleted file mode 100644
index 3fe2941..0000000
--- a/task/rhacs-image-scan/3.71/samples/pipeline.yaml
+++ /dev/null
@@ -1,100 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: rox-pipeline
-spec:
-
-  workspaces:
-    - name: shared-workspace
-
-  params:
-    - name: deployment-name
-      type: string
-      description: name of the deployment resource to be patched
-    - name: deployment
-      type: string
-      description: filename of the deployment to be patched
-    - name: git-url
-      type: string
-      description: url of the git repo for the code of deployment
-    - name: git-revision
-      type: string
-      description: revision to be used from repo of the code for deployment
-      default: main
-    - name: IMAGE
-      type: string
-      description: image to be build from the code
-
-  tasks:
-    # checkout source code
-    - name: fetch-repository
-      taskRef:
-        name: git-clone
-        kind: ClusterTask
-      workspaces:
-      - name: output
-        workspace: shared-workspace
-      params:
-      - name: url
-        value: $(params.git-url)
-      - name: subdirectory
-        value: ""
-      - name: deleteExisting
-        value: "true"
-      - name: revision
-        value: $(params.git-revision)
-
-    # validate deployment against defined  RHACS policies
-    - name: police-deployment
-      taskRef:
-        name: rhacs-deployment-check
-        kind: Task
-      workspaces:
-      - name: source
-        workspace: shared-workspace
-      params:
-      - name: deployment
-        value: $(params.deployment)
-      - name: insecure-skip-tls-verify
-        value: "true"
-      runAfter:
-      - fetch-repository
-
-    - name: build-image
-      taskRef:
-        name: buildah
-        kind: ClusterTask
-      params:
-      - name: IMAGE
-        value: $(params.IMAGE)
-      workspaces:
-      - name: source
-        workspace: shared-workspace
-      runAfter:
-      - fetch-repository
-
-    # scan image for vulns using RHACS
-    - name: scan-image
-      taskRef:
-        name: rhacs-image-scan
-        kind: Task
-      params:
-      - name: image
-        value: "$(params.IMAGE)@$(tasks.build-image.results.IMAGE_DIGEST)"
-      - name: insecure-skip-tls-verify
-        value: "true" # stackrox to OCP image registry x509 fail...
-      runAfter:
-      - build-image
-
-    # validate image against RHACS policies
-    - name: police-image
-      taskRef:
-        name: rhacs-image-check
-        kind: Task
-      params:
-      - name: image
-        value: "$(params.IMAGE)@$(tasks.build-image.results.IMAGE_DIGEST)"
-      - name: insecure-skip-tls-verify
-        value: "true"
-      runAfter:
-      - scan-image
diff --git a/task/rhacs-image-scan/4.0/samples/with-api-token/secrets.yaml b/task/rhacs-image-scan/4.0/samples/with-api-token/secrets.yaml
deleted file mode 100644
index 304f9b0..0000000
--- a/task/rhacs-image-scan/4.0/samples/with-api-token/secrets.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
----
-apiVersion: v1
-kind: Secret
-type: Opaque
-metadata:
-  name: rox-api-token
-data:
-  rox_api_token: EXAMPLE
----
-apiVersion: v1
-kind: Secret
-type: Opaque
-data:
-  rox_central_endpoint: Y2VudHJhbC5zdGFja3JveC5zdmM6NDQz
-metadata:
-  name: rox-central-endpoint
diff --git a/task/rhacs-image-scan/4.0/samples/with-m2m-token/pipelinerun.yaml b/task/rhacs-image-scan/4.0/samples/with-m2m-token/pipelinerun.yaml
deleted file mode 100644
index ccdfa5f..0000000
--- a/task/rhacs-image-scan/4.0/samples/with-m2m-token/pipelinerun.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
----
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  name: rox-pipelinerun
-spec:
-  pipelineRef:
-    name: rox-pipeline
-  params:
-  - name: deployment-name
-    value: pipelines-vote-api
-  - name: deployment
-    value: k8s/deployment.yaml
-  - name: git-url
-    value: https://github.com/openshift/pipelines-vote-api.git
-  - name: git-revision
-    value: pipelines-1.7
-  - name: IMAGE
-    value: image-registry.openshift-image-registry.svc:5000/$(context.pipelineRun.namespace)/pipelines-vote-ui
-  - name: insecure-skip-tls-verify
-    value: "true"
-  workspaces:
-  - name: shared-workspace
-    volumeClaimTemplate:
-      spec:
-        accessModes:
-          - ReadWriteOnce
-        resources:
-          requests:
-            storage: 500Mi
diff --git a/task/rhacs-image-scan/OWNERS b/task/rhacs-image-scan/OWNERS
deleted file mode 100644
index 1af341f..0000000
--- a/task/rhacs-image-scan/OWNERS
+++ /dev/null
@@ -1,6 +0,0 @@
-approvers:
-- dlbewley
-- MoOyeg
-reviewers:
-- dlbewley
-- MoOyeg
diff --git a/task/rhacs-image-scan/3.71/samples/secrets.yaml b/task/rhacs-image-scan/4.0/samples/with-api-token/secrets.yaml
similarity index 100%
rename from task/rhacs-image-scan/3.71/samples/secrets.yaml
rename to task/rhacs-image-scan/4.0/samples/with-api-token/secrets.yaml
diff --git a/task/rhacs-image-scan/3.71/samples/pipelinerun.yaml b/task/rhacs-image-scan/4.0/samples/with-m2m-token/pipelinerun.yaml
similarity index 100%
rename from task/rhacs-image-scan/3.71/samples/pipelinerun.yaml
rename to task/rhacs-image-scan/4.0/samples/with-m2m-token/pipelinerun.yaml

[dhaus67]

/kind feature

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• ~~OWNERS~~ [vdemeester]

Approvers can indicate their approval by writing /approve in a comment Approvers can cancel approval by writing /approve cancel in a comment

[dhaus67]

/assign vdemeester