-
Bug
-
Resolution: Done
-
Critical
-
None
-
ACM 2.14.0
-
Quality / Stability / Reliability
-
False
-
-
False
-
-
-
Critical
-
None
Description of problem:
These are new EC failures in submariner addon.
Example failures:
✕ [Violation] tasks.required_tasks_found ImageRef: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/submariner-addon-acm-214@sha256:f4abdd34eacb437ea570666c05a11c07444c2156223b396e936986bccc63dad6 Reason: Required task "deprecated-image-check" is missing Term: deprecated-image-check Title: All required tasks were included in the pipeline Description: Ensure that the set of required tasks are included in the PipelineRun attestation. To exclude this rule add "tasks.required_tasks_found:deprecated-image-check" to the `exclude` section of the policy configuration. Solution: Make sure all required tasks are in the build pipeline. The required task list is contained as https://conforma.dev/docs/ec-cli/configuration.html#_data_sources under the key 'required-tasks'. ✕ [Violation] trusted_task.trusted ImageRef: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/submariner-addon-acm-214@sha256:f4abdd34eacb437ea570666c05a11c07444c2156223b396e936986bccc63dad6 Reason: Untrusted version of PipelineTask "deprecated-base-image-check" (Task "deprecated-image-check") was included in build chain comprised of: deprecated-base-image-check. Please upgrade the task version to: sha256:ecd33669676b3a193ff4c2c6223cb912cc1b0cf5cc36e080eaec7718500272cf Term: deprecated-image-check Title: Tasks are trusted Description: Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude this rule add "trusted_task.trusted:deprecated-image-check" to the `exclude` section of the policy configuration. Solution: If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks when newer versions are made available. ✕ [Violation] tasks.required_tasks_found ImageRef: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/submariner-addon-acm-214@sha256:df5637960f7dbbc224c3f1806941d384504f55aa4e5c5c813f775da301cd861f Reason: Required task "deprecated-image-check" is missing Term: deprecated-image-check Title: All required tasks were included in the pipeline Description: Ensure that the set of required tasks are included in the PipelineRun attestation. To exclude this rule add "tasks.required_tasks_found:deprecated-image-check" to the `exclude` section of the policy configuration. Solution: Make sure all required tasks are in the build pipeline. The required task list is contained as https://conforma.dev/docs/ec-cli/configuration.html#_data_sources under the key 'required-tasks'.
For the full log see https://konflux-ui.apps.stone-prd-rh01.pg1f.p1.openshiftapps.com/ns/crt-redhat-acm-tenant/applications/release-acm-214/pipelineruns/managed-s8n98
Version-Release number of selected component (if applicable):
How reproducible:
Steps to Reproduce:
- ...