Uploaded image for project: 'Red Hat Advanced Cluster Management'
  1. Red Hat Advanced Cluster Management
  2. ACM-20666

Enterprise contract failures for acm memcached-exporter

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Blocker Blocker
    • None
    • ACM 2.14.0
    • Observability
    • Product / Portfolio Work
    • 1
    • False
    • Hide

      None

      Show
      None
    • False
    • Observability Sprint 42
    • Critical
    • None

      Description of problem:

      There are many failures. Make sure you have attempted a build with updated pipelines

      Some violations are

      [Violation] labels.disallowed_inherited_labels
        ImageRef: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/memcached-exporter-acm-214@sha256:266ea5d658c53ba98c5fc161cc5fed39a436582ffd9b93bacadecf9e18c17c7d
        Reason: The "summary" label should not be inherited from the parent image
        Term: summary
        Title: Disallowed inherited labels
        Description: Check that certain labels on the image have different values than the labels from the parent image. If the label is
        inherited from the parent image but not redefined for the image, it will contain an incorrect value for the image. Use the rule
        data `disallowed_inherited_labels` key to set the list of labels to check, or the `fbc_disallowed_inherited_labels` key for fbc
        images. To exclude this rule add "labels.disallowed_inherited_labels:summary" to the `exclude` section of the policy
        configuration.
        Solution: Update the image build process to overwrite the inherited labels.

      [Violation] slsa_build_scripted_build.image_built_by_trusted_task
        ImageRef: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/memcached-exporter-acm-214@sha256:266ea5d658c53ba98c5fc161cc5fed39a436582ffd9b93bacadecf9e18c17c7d
        Reason: Image
        "quay.io/redhat-user-workloads/crt-redhat-acm-tenant/memcached-exporter-acm-214@sha256:266ea5d658c53ba98c5fc161cc5fed39a436582ffd9b93bacadecf9e18c17c7d"
        not built by a trusted task: Build Task(s) "build-image-index,buildah-remote-oci-ta" are not trusted
        Title: Image built by trusted Task
        Description: Verify the digest of the image being validated is reported by a trusted Task in its IMAGE_DIGEST result. To exclude
        this rule add "slsa_build_scripted_build.image_built_by_trusted_task" to the `exclude` section of the policy configuration.
        Solution: Make sure the build Pipeline definition uses a trusted Task to build images.

      [Violation] source_image.exists
        ImageRef: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/memcached-exporter-acm-214@sha256:266ea5d658c53ba98c5fc161cc5fed39a436582ffd9b93bacadecf9e18c17c7d
        Reason: No source image references found
        Title: Exists
        Description: Verify the source container image exists. To exclude this rule add "source_image.exists" to the `exclude` section
        of the policy configuration.

      [Violation] tasks.required_tasks_found
        ImageRef: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/memcached-exporter-acm-214@sha256:266ea5d658c53ba98c5fc161cc5fed39a436582ffd9b93bacadecf9e18c17c7d
        Reason: One of "buildah", "buildah-10gb", "buildah-6gb", "buildah-8gb", "buildah-remote", "buildah-oci-ta",
        "buildah-remote-oci-ta" tasks is missing
        Terms: buildah, buildah-10gb, buildah-6gb, buildah-8gb, buildah-remote, buildah-oci-ta, buildah-remote-oci-ta
        Title: All required tasks were included in the pipeline
        Description: Ensure that the set of required tasks are included in the PipelineRun attestation. To exclude this rule add one or
        more of "tasks.required_tasks_found:buildah", "tasks.required_tasks_found:buildah-10gb",
        "tasks.required_tasks_found:buildah-6gb", "tasks.required_tasks_found:buildah-8gb", "tasks.required_tasks_found:buildah-remote",
        "tasks.required_tasks_found:buildah-oci-ta", "tasks.required_tasks_found:buildah-remote-oci-ta" to the `exclude` section of the
        policy configuration.
        Solution: Make sure all required tasks are in the build pipeline. The required task list is contained as
        https://conforma.dev/docs/ec-cli/configuration.html#_data_sources under the key 'required-tasks'.

       

      Version-Release number of selected component (if applicable):

      How reproducible:

      Steps to Reproduce:

      1.  
      2.  
      3. ...

      Actual results:

      Expected results:

      Additional info:

              rh-ee-jachanse Jacob Baungard Hansen
              gparvin-redhat Gus Parvin
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: