Dereference the PipelineSpec into PipelineRun.Status

The Pipeline definition used for a PipelineRun can change after the
PipelineRun has started. This poses problems for auditability post-run. Rather
than chase down every part of a Pipeline that we might like to audit later,
let's just add the entire thing here.

This is a follow up to tektoncd#2444.

docs/pipelineruns.md

@@ -30,6 +30,11 @@ executed successfully or a failure occurs.
 **Note:** A `PipelineRun` automatically creates corresponding `TaskRuns` for every
 `Task` in your `Pipeline`.
 
+The `Status` field tracks the current state of a `PipelineRun`, and can be used to monitor
+progress.
+This field containts the status of every `TaskRun`, as well as the full `PipelineSpec` used
+to instantiate this `PipelineRun`, for full auditability.
+
 ## Configuring a `PipelineRun`
 
 A `PipelineRun` definition supports the following fields:

go.mod

@@ -40,7 +40,6 @@ require (
  golang.org/x/time v0.0.0-20191024005414-555d28b269f0 // indirect
  golang.org/x/tools v0.0.0-20200214144324-88be01311a71 // indirect
  gomodules.xyz/jsonpatch/v2 v2.1.0
- google.golang.org/api v0.15.0 // indirect
  google.golang.org/appengine v1.6.5 // indirect
  k8s.io/api v0.17.3
  k8s.io/apiextensions-apiserver v0.17.3 // indirect

pkg/apis/pipeline/v1beta1/pipelinerun_types.go

@@ -255,6 +255,9 @@ type PipelineRunStatusFields struct {
  // PipelineResults are the list of results written out by the pipeline task's containers
  // +optional
  PipelineResults []PipelineRunResult `json:"pipelineResults,omitempty"`
+
+ // PipelineRunSpec contains the exact spec used to instantiate the run
+ PipelineSpec *PipelineSpec `json:"pipelineSpec,omitempty"`
 }
 
 // PipelineRunResult used to describe the results of a pipeline

pkg/reconciler/pipelinerun/pipelinerun.go

@@ -359,6 +359,11 @@ func (c *Reconciler) reconcile(ctx context.Context, pr *v1alpha1.PipelineRun) er
  return nil
  }
 
+ // Store the fetched PipelineSpec on the PipelineRun for auditing
+ if err := storePipelineSpec(ctx, pr, pipelineSpec); err != nil {
+ c.Logger.Errorf("Failed to store PipelineSpec on PipelineRun.Status for pipelinerun %s: %v", pr.Name, err)
+ }
+
  // Propagate labels from Pipeline to PipelineRun.
  if pr.ObjectMeta.Labels == nil {
  pr.ObjectMeta.Labels = make(map[string]string, len(pipelineMeta.Labels)+1)
@@ -906,3 +911,12 @@ func (c *Reconciler) makeConditionCheckContainer(rprt *resources.ResolvedPipelin
  cc := v1alpha1.ConditionCheck(*cctr)
  return &cc, err
 }
+
+func storePipelineSpec(ctx context.Context, pr *v1alpha1.PipelineRun, ps *v1alpha1.PipelineSpec) error {
+ // Only store the TaskSpec once, if it has never been set before.
+ if pr.Status.PipelineSpec == nil {
+ pr.Status.PipelineSpec = &v1beta1.PipelineSpec{}
+ return ps.ConvertTo(ctx, pr.Status.PipelineSpec)
+ }
+ return nil
+}

pkg/reconciler/pipelinerun/pipelinerun_test.go

@@ -2042,3 +2042,31 @@ func TestReconcileWithPipelineResults(t *testing.T) {
  t.Errorf("expected to see pipeline run results created. -want, +got: Diff %s", d)
  }
 }
+
+func Test_storePipelineSpec(t *testing.T) {
+ ctx := context.Background()
+ pr := tb.PipelineRun("foo")
+
+ ps := tb.Pipeline("some-pipeline", tb.PipelineSpec(tb.PipelineDescription("foo-pipeline"))).Spec
+ want := &v1beta1.PipelineSpec{}
+ if err := ps.ConvertTo(ctx, want); err != nil {
+ t.Errorf("error converting to v1beta1: %v", err)
+ }
+
+ // The first time we set it, it should get copied.
+ if err := storePipelineSpec(ctx, pr, &ps); err != nil {
+ t.Errorf("storePipelineSpec() error = %v", err)
+ }
+ if d := cmp.Diff(pr.Status.PipelineSpec, want); d != "" {
+ t.Fatalf("-want, +got: %v", d)
+ }
+
+ ps.Description = "new-pipeline"
+ // The next time, it should not get overwritten
+ if err := storePipelineSpec(ctx, pr, &ps); err != nil {
+ t.Errorf("storePipelineSpec() error = %v", err)
+ }
+ if d := cmp.Diff(pr.Status.PipelineSpec, want); d != "" {
+ t.Fatalf("-want, +got: %v", d)
+ }
+}