Uploaded image for project: 'Red Hat Advanced Cluster Management'
  1. Red Hat Advanced Cluster Management
  2. ACM-21527

Enterprise contract failures for acm submariner addon

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Critical Critical
    • None
    • ACM 2.14.0
    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • False
    • Critical
    • None

      Description of problem:

      These are new EC failures in submariner addon.

      Example failures:

       

      ✕ [Violation] tasks.required_tasks_found
        ImageRef: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/submariner-addon-acm-214@sha256:f4abdd34eacb437ea570666c05a11c07444c2156223b396e936986bccc63dad6
        Reason: Required task "deprecated-image-check" is missing
        Term: deprecated-image-check
        Title: All required tasks were included in the pipeline
        Description: Ensure that the set of required tasks are included in the PipelineRun attestation. To exclude this rule add
        "tasks.required_tasks_found:deprecated-image-check" to the `exclude` section of the policy configuration.
        Solution: Make sure all required tasks are in the build pipeline. The required task list is contained as
        https://conforma.dev/docs/ec-cli/configuration.html#_data_sources under the key 'required-tasks'.
            
      ✕ [Violation] trusted_task.trusted
        ImageRef: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/submariner-addon-acm-214@sha256:f4abdd34eacb437ea570666c05a11c07444c2156223b396e936986bccc63dad6
        Reason: Untrusted version of PipelineTask "deprecated-base-image-check" (Task "deprecated-image-check") was included in build
        chain comprised of: deprecated-base-image-check. Please upgrade the task version to:
        sha256:ecd33669676b3a193ff4c2c6223cb912cc1b0cf5cc36e080eaec7718500272cf
        Term: deprecated-image-check
        Title: Tasks are trusted
        Description: Check the trust of the Tekton Tasks used in the build Pipeline. There are two modes in which trust is verified. The
        first mode is used if Trusted Artifacts are enabled. In this case, a chain of trust is established for all the Tasks involved in
        creating an artifact. If the chain contains an untrusted Task, then a violation is emitted. The second mode is used as a
        fallback when Trusted Artifacts are not enabled. In this case, **all** Tasks in the build Pipeline must be trusted. To exclude
        this rule add "trusted_task.trusted:deprecated-image-check" to the `exclude` section of the policy configuration.
        Solution: If using Trusted Artifacts, be sure every Task in the build Pipeline responsible for producing a Trusted Artifact is
        trusted. Otherwise, ensure **all** Tasks in the build Pipeline are trusted. Note that trust is eventually revoked from Tasks
        when newer versions are made available.
      ✕ [Violation] tasks.required_tasks_found
        ImageRef: quay.io/redhat-user-workloads/crt-redhat-acm-tenant/submariner-addon-acm-214@sha256:df5637960f7dbbc224c3f1806941d384504f55aa4e5c5c813f775da301cd861f
        Reason: Required task "deprecated-image-check" is missing
        Term: deprecated-image-check
        Title: All required tasks were included in the pipeline
        Description: Ensure that the set of required tasks are included in the PipelineRun attestation. To exclude this rule add
        "tasks.required_tasks_found:deprecated-image-check" to the `exclude` section of the policy configuration.
        Solution: Make sure all required tasks are in the build pipeline. The required task list is contained as
        https://conforma.dev/docs/ec-cli/configuration.html#_data_sources under the key 'required-tasks'.
      

       

      For the full log see https://konflux-ui.apps.stone-prd-rh01.pg1f.p1.openshiftapps.com/ns/crt-redhat-acm-tenant/applications/release-acm-214/pipelineruns/managed-s8n98

      Version-Release number of selected component (if applicable):

      How reproducible:

      Steps to Reproduce:

      1.  
      2.  
      3. ...

      Actual results:

      Expected results:

      Additional info:

              dfarrell07 Daniel Farrell
              gparvin-redhat Gus Parvin
              Prachi Yadav Prachi Yadav
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: