feat: support for variable interpolation in workspace.* (in PipelineR…

…un and TaskRun) fix #7667 Support for variable interpolation in: * spec.workspaces[].configMap.items[].* * spec.workspaces[].secret.items[].* * spec.workspaces[].projected.sources[].configMap.items[].* * spec.workspaces[].projected.sources[].secret.items[].*
tektoncd · Feb 26, 2024 · 33365cf · 33365cf
1 parent 459808c
commit 33365cf
Show file tree

Hide file tree

Showing 6 changed files with 393 additions and 122 deletions.
diff --git a/docs/variables.md b/docs/variables.md
@@ -120,11 +120,20 @@ For instructions on using variable substitutions see the relevant section of [th
 | `Task`        | `spec.sidecars[].args`                                          |
 | `Task`        | `spec.sidecars[].script`                                        |
 | `Task`        | `spec.workspaces[].mountPath`                                   |
+| `TaskRun`     | `spec.workspaces[].subPath`                                     |
 | `TaskRun`     | `spec.workspaces[].persistentVolumeClaim.claimName`             |
 | `TaskRun`     | `spec.workspaces[].configMap.name`                              |
+| `TaskRun`     | `spec.workspaces[].configMap.items[].key`                       |
+| `TaskRun`     | `spec.workspaces[].configMap.items[].path`                      |
 | `TaskRun`     | `spec.workspaces[].secret.secretName`                           |
+| `TaskRun`     | `spec.workspaces[].secret.items[].key`                          |
+| `TaskRun`     | `spec.workspaces[].secret.items[].path`                         |
 | `TaskRun`     | `spec.workspaces[].projected.sources[].secret.name`             |
+| `TaskRun`     | `spec.workspaces[].projected.sources[].secret.items[].key`      |
+| `TaskRun`     | `spec.workspaces[].projected.sources[].secret.items[].path`     |
 | `TaskRun`     | `spec.workspaces[].projected.sources[].configMap.name`          |
+| `TaskRun`     | `spec.workspaces[].projected.sources[].configMap.items[].key`   |
+| `TaskRun`     | `spec.workspaces[].projected.sources[].configMap.items[].path`  |
 | `TaskRun`     | `spec.workspaces[].csi.driver`                                  |
 | `TaskRun`     | `spec.workspaces[].csi.nodePublishSecretRef.name`               |
 | `Pipeline`    | `spec.tasks[].params[].value`                                   |
@@ -134,10 +143,19 @@ For instructions on using variable substitutions see the relevant section of [th
 | `Pipeline`    | `spec.tasks[].when[].values`                                    |
 | `Pipeline`    | `spec.tasks[].workspaces[].subPath`                             |
 | `Pipeline`    | `spec.tasks[].displayName`                                      |
+| `PipelineRun` | `spec.workspaces[].subPath`                                     |
 | `PipelineRun` | `spec.workspaces[].persistentVolumeClaim.claimName`             |
 | `PipelineRun` | `spec.workspaces[].configMap.name`                              |
+| `PipelineRun` | `spec.workspaces[].configMap.items[].key`                       |
+| `PipelineRun` | `spec.workspaces[].configMap.items[].path`                      |
 | `PipelineRun` | `spec.workspaces[].secret.secretName`                           |
+| `PipelineRun` | `spec.workspaces[].secret.items[].key`                          |
+| `PipelineRun` | `spec.workspaces[].secret.items[].path`                         |
 | `PipelineRun` | `spec.workspaces[].projected.sources[].secret.name`             |
+| `PipelineRun` | `spec.workspaces[].projected.sources[].secret.items[].key`      |
+| `PipelineRun` | `spec.workspaces[].projected.sources[].secret.items[].path`     |
 | `PipelineRun` | `spec.workspaces[].projected.sources[].configMap.name`          |
+| `PipelineRun` | `spec.workspaces[].projected.sources[].configMap.items[].key`   |
+| `PipelineRun` | `spec.workspaces[].projected.sources[].configMap.items[].path`  |
 | `PipelineRun` | `spec.workspaces[].csi.driver`                                  |
 | `PipelineRun` | `spec.workspaces[].csi.nodePublishSecretRef.name`               |
diff --git a/pkg/reconciler/pipelinerun/pipelinerun_test.go b/pkg/reconciler/pipelinerun/pipelinerun_test.go
@@ -4891,18 +4891,18 @@ spec:
       steps:
         - name: s1
           image: alpine
-          script: | 
+          script: |
             echo $(params.version) + $(params.tag)
   - name: b-task
-    params: 
+    params:
     - name: ref-p1
       value: $(params.version)
     - name: ref-p2
       value: "v3"
     taskRef:
       name: ref-task
   - name: c-task-matrixed
-    matrix: 
+    matrix:
       params:
       - name: ref-p1
         value: [v1, v2]
@@ -4981,7 +4981,7 @@ spec:
       steps:
         - name: s1
           image: alpine
-          script: | 
+          script: |
             echo $(params.version)
 `)}
 	prs := []*v1.PipelineRun{parse.MustParseV1PipelineRun(t, `
@@ -5870,8 +5870,8 @@ spec:
 `),
 	}
 	trs := []*v1.TaskRun{mustParseTaskRunWithObjectMeta(t,
-		taskRunObjectMeta("test-pipeline-run-different-service-accs-a-task-xxyyy", "foo",
-			"test-pipeline-run-different-service-accs", "test-pipeline", "a-task", true),
+		taskRunObjectMeta("test-pipeline-run-variable-substitution-a-task-xxyyy", "foo",
+			"test-pipeline-run-variable-substitution", "test-pipeline", "a-task", true),
 		`
 spec:
   serviceAccountName: test-sa
@@ -5899,7 +5899,7 @@ status:
 			name: "pcv success",
 			prs: []*v1.PipelineRun{parse.MustParseV1PipelineRun(t, `
 metadata:
-  name: test-pipeline-run-different-service-accs
+  name: test-pipeline-run-variable-substitution
   namespace: foo
 spec:
   pipelineRef:
@@ -5913,8 +5913,8 @@ spec:
 `)},
 			disableAA: true,
 			expectedTr: mustParseTaskRunWithObjectMeta(t,
-				taskRunObjectMeta("test-pipeline-run-different-service-accs-b-task", "foo",
-					"test-pipeline-run-different-service-accs", "test-pipeline", "b-task", false),
+				taskRunObjectMeta("test-pipeline-run-variable-substitution-b-task", "foo",
+					"test-pipeline-run-variable-substitution", "test-pipeline", "b-task", false),
 				`spec:
   serviceAccountName: test-sa-0
   taskRef:
@@ -5930,7 +5930,7 @@ spec:
 			name: "subPath success",
 			prs: []*v1.PipelineRun{parse.MustParseV1PipelineRun(t, `
 metadata:
-  name: test-pipeline-run-different-service-accs
+  name: test-pipeline-run-variable-substitution
   namespace: foo
 spec:
   pipelineRef:
@@ -5942,8 +5942,8 @@ spec:
       subPath: $(tasks.a-task.results.aResult)
 `)},
 			expectedTr: mustParseTaskRunWithObjectMeta(t,
-				taskRunObjectMeta("test-pipeline-run-different-service-accs-b-task", "foo",
-					"test-pipeline-run-different-service-accs", "test-pipeline", "b-task", false),
+				taskRunObjectMeta("test-pipeline-run-variable-substitution-b-task", "foo",
+					"test-pipeline-run-variable-substitution", "test-pipeline", "b-task", false),
 				`spec:
   serviceAccountName: test-sa-0
   taskRef:
@@ -5958,7 +5958,7 @@ spec:
 			name: "secret.secretName success",
 			prs: []*v1.PipelineRun{parse.MustParseV1PipelineRun(t, `
 metadata:
-  name: test-pipeline-run-different-service-accs
+  name: test-pipeline-run-variable-substitution
   namespace: foo
 spec:
   pipelineRef:
@@ -5967,12 +5967,12 @@ spec:
     serviceAccountName: test-sa-0
   workspaces:
     - name: ws-1
-      secret: 
+      secret:
         secretName: $(tasks.a-task.results.aResult)
 `)},
 			expectedTr: mustParseTaskRunWithObjectMeta(t,
-				taskRunObjectMeta("test-pipeline-run-different-service-accs-b-task", "foo",
-					"test-pipeline-run-different-service-accs", "test-pipeline", "b-task", false),
+				taskRunObjectMeta("test-pipeline-run-variable-substitution-b-task", "foo",
+					"test-pipeline-run-variable-substitution", "test-pipeline", "b-task", false),
 				`spec:
   serviceAccountName: test-sa-0
   taskRef:
@@ -5988,7 +5988,7 @@ spec:
 			name: "projected.sources.configMap.name success",
 			prs: []*v1.PipelineRun{parse.MustParseV1PipelineRun(t, `
 metadata:
-  name: test-pipeline-run-different-service-accs
+  name: test-pipeline-run-variable-substitution
   namespace: foo
 spec:
   pipelineRef:
@@ -5997,32 +5997,32 @@ spec:
     serviceAccountName: test-sa-0
   workspaces:
     - name: ws-1
-      projected: 
+      projected:
         sources:
          - configMap:
              name: $(tasks.a-task.results.aResult)
 `)},
 			expectedTr: mustParseTaskRunWithObjectMeta(t,
-				taskRunObjectMeta("test-pipeline-run-different-service-accs-b-task", "foo",
-					"test-pipeline-run-different-service-accs", "test-pipeline", "b-task", false),
+				taskRunObjectMeta("test-pipeline-run-variable-substitution-b-task", "foo",
+					"test-pipeline-run-variable-substitution", "test-pipeline", "b-task", false),
 				`spec:
   serviceAccountName: test-sa-0
   taskRef:
     name: b-task
     kind: Task
   workspaces:
     - name: s1
-      projected: 
+      projected:
         sources:
          - configMap:
-             name: aResultValue 
+             name: aResultValue
 `),
 		},
 		{
 			name: "projected.sources.secret.name success",
 			prs: []*v1.PipelineRun{parse.MustParseV1PipelineRun(t, `
 metadata:
-  name: test-pipeline-run-different-service-accs
+  name: test-pipeline-run-variable-substitution
   namespace: foo
 spec:
   pipelineRef:
@@ -6031,32 +6031,72 @@ spec:
     serviceAccountName: test-sa-0
   workspaces:
     - name: ws-1
-      projected: 
+      projected:
         sources:
          - secret:
              name: $(tasks.a-task.results.aResult)
 `)},
 			expectedTr: mustParseTaskRunWithObjectMeta(t,
-				taskRunObjectMeta("test-pipeline-run-different-service-accs-b-task", "foo",
-					"test-pipeline-run-different-service-accs", "test-pipeline", "b-task", false),
+				taskRunObjectMeta("test-pipeline-run-variable-substitution-b-task", "foo",
+					"test-pipeline-run-variable-substitution", "test-pipeline", "b-task", false),
+				`spec:
+  serviceAccountName: test-sa-0
+  taskRef:
+    name: b-task
+    kind: Task
+  workspaces:
+    - name: s1
+      projected:
+        sources:
+         - secret:
+             name: aResultValue
+`),
+		},
+		{
+			name: "projected.sources.secret.items success",
+			prs: []*v1.PipelineRun{parse.MustParseV1PipelineRun(t, `
+metadata:
+  name: test-pipeline-run-variable-substitution
+  namespace: foo
+spec:
+  pipelineRef:
+    name: test-pipeline
+  taskRunTemplate:
+    serviceAccountName: test-sa-0
+  workspaces:
+    - name: ws-1
+      projected:
+        sources:
+         - secret:
+             name: name
+             items:
+               - key: $(tasks.a-task.results.aResult)
+                 path: $(tasks.a-task.results.aResult)
+`)},
+			expectedTr: mustParseTaskRunWithObjectMeta(t,
+				taskRunObjectMeta("test-pipeline-run-variable-substitution-b-task", "foo",
+					"test-pipeline-run-variable-substitution", "test-pipeline", "b-task", false),
 				`spec:
   serviceAccountName: test-sa-0
   taskRef:
     name: b-task
     kind: Task
   workspaces:
     - name: s1
-      projected: 
+      projected:
         sources:
          - secret:
-             name: aResultValue 
+             name: name
+             items:
+               - key: aResultValue
+                 path: aResultValue
 `),
 		},
 		{
 			name: "csi.driver success",
 			prs: []*v1.PipelineRun{parse.MustParseV1PipelineRun(t, `
 metadata:
-  name: test-pipeline-run-different-service-accs
+  name: test-pipeline-run-variable-substitution
   namespace: foo
 spec:
   pipelineRef:
@@ -6069,8 +6109,8 @@ spec:
         driver: $(tasks.a-task.results.aResult)
 `)},
 			expectedTr: mustParseTaskRunWithObjectMeta(t,
-				taskRunObjectMeta("test-pipeline-run-different-service-accs-b-task", "foo",
-					"test-pipeline-run-different-service-accs", "test-pipeline", "b-task", false),
+				taskRunObjectMeta("test-pipeline-run-variable-substitution-b-task", "foo",
+					"test-pipeline-run-variable-substitution", "test-pipeline", "b-task", false),
 				`spec:
   serviceAccountName: test-sa-0
   taskRef:
@@ -6079,14 +6119,14 @@ spec:
   workspaces:
     - name: s1
       csi:
-        driver: aResultValue 
+        driver: aResultValue
 `),
 		},
 		{
 			name: "nodePublishSecretRef.name success",
 			prs: []*v1.PipelineRun{parse.MustParseV1PipelineRun(t, `
 metadata:
-  name: test-pipeline-run-different-service-accs
+  name: test-pipeline-run-variable-substitution
   namespace: foo
 spec:
   pipelineRef:
@@ -6100,8 +6140,8 @@ spec:
           name: $(tasks.a-task.results.aResult)
 `)},
 			expectedTr: mustParseTaskRunWithObjectMeta(t,
-				taskRunObjectMeta("test-pipeline-run-different-service-accs-b-task", "foo",
-					"test-pipeline-run-different-service-accs", "test-pipeline", "b-task", false),
+				taskRunObjectMeta("test-pipeline-run-variable-substitution-b-task", "foo",
+					"test-pipeline-run-variable-substitution", "test-pipeline", "b-task", false),
 				`spec:
   serviceAccountName: test-sa-0
   taskRef:
@@ -6110,7 +6150,7 @@ spec:
   workspaces:
     - name: s1
       csi:
-        nodePublishSecretRef: 
+        nodePublishSecretRef:
           name: aResultValue
 `),
 		},
@@ -6132,10 +6172,10 @@ spec:
 			prt := newPipelineRunTest(t, d)
 			defer prt.Cancel()
 
-			_, clients := prt.reconcileRun("foo", "test-pipeline-run-different-service-accs", []string{}, false)
+			_, clients := prt.reconcileRun("foo", "test-pipeline-run-variable-substitution", []string{}, false)
 			// Check that the expected TaskRun was created
 			actual, err := clients.Pipeline.TektonV1().TaskRuns("foo").List(prt.TestAssets.Ctx, metav1.ListOptions{
-				LabelSelector: "tekton.dev/pipelineTask=b-task,tekton.dev/pipelineRun=test-pipeline-run-different-service-accs",
+				LabelSelector: "tekton.dev/pipelineTask=b-task,tekton.dev/pipelineRun=test-pipeline-run-variable-substitution",
 				Limit:         1,
 			})