Task Policy

These rules are applied to Tekton task definitions.

1. Tekton Task Step image policies

This package ensures that a Task definition contains expected values for the image references used by the Task’s steps.

  • Package name: step_image_registries

  • Package full path: policy.task.step_image_registries

1.1. Permitted step image registry prefix list provided

Confirm the allowed_step_image_registry_prefixes rule data was provided, since it’s required by the policy rules in this package.

Solution: Make sure the data sources contains a key 'allowed_step_image_registry_prefixes' that contains a list of approved registries that can be used to run tasks in the build pipeline.

  • Rule type: FAILURE

  • FAILURE message: %s

  • Code: step_image_registries.step_image_registry_prefix_list_provided

  • Source

1.2. Step images come from permitted registry

Confirm that each step in the Task uses a container image with a URL that matches one of the prefixes in the provided list of allowed step image registry prefixes. The list is customizeable via the allowed_step_image_registry_prefixes rule data key.

Solution: Make sure the container image used in each step of the Task comes from an approved registry.

  • Rule type: FAILURE

  • FAILURE message: Step %d uses disallowed image ref '%s'

  • Code: step_image_registries.step_images_permitted

  • Source

2. Tekton Task annotations

Policies to verify that a Tekton Task definition uses well formed expected annotations .

  • Package name: annotation

  • Package full path: policy.task.annotation

2.1. Task definition uses expires-on annotation in RFC3339 format

Make sure to use the date format in RFC3339 format in the "build.appstudio.redhat.com/expires-on" annotation.

  • Rule type: FAILURE

  • FAILURE message: Expires on time is not in RFC3339 format: %q

  • Code: annotation.expires_on_format

  • Source

3. Tekton task kind checks

Policies to verify that a Tekton task definition has the expected value for kind.

  • Package name: kind

  • Package full path: policy.task.kind

3.1. Kind field is present in task definition

Confirm the task definition includes the kind field.

  • Rule type: FAILURE

  • FAILURE message: Required field 'kind' not found

  • Code: kind.kind_present

  • Source

3.2. Task definition has expected kind

Confirm the task definition has the kind "Task".

  • Rule type: FAILURE

  • FAILURE message: Unexpected kind '%s' for task definition

  • Code: kind.expected_kind

  • Source

4. Trusted Artifacts Conventions

Policies to verify that a Tekton task definition conforms to the expected conventions required for using Trusted Artifacts.

  • Package name: trusted_artifacts

  • Package full path: policy.task.trusted_artifacts

4.1. Parameter

Trusted Artifact parameters follow the expected naming convention.

  • Rule type: FAILURE

  • FAILURE message: The parameter %q of the Task %q does not use the _ARTIFACT suffix

  • Code: trusted_artifacts.parameter

  • Source

4.2. Result

Trusted Artifact results follow the expected naming convention.

  • Rule type: FAILURE

  • FAILURE message: The result %q of the Task %q does not use the _ARTIFACT suffix

  • Code: trusted_artifacts.result

  • Source