Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Rego interceptor #484

Closed
bobcatfish opened this issue Mar 17, 2020 · 15 comments
Closed

Add Rego interceptor #484

bobcatfish opened this issue Mar 17, 2020 · 15 comments
Labels
kind/feature Categorizes issue or PR as related to a new feature. lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed.

Comments

@bobcatfish
Copy link
Collaborator

Expected Behavior

In addition to supporting CEL for filtering and mutation of payloads, we can support other options out of the box, such as Rego.

Actual Behavior

We only support CEL, tho folks can bring their own interceptors of course!

Additional Info

To actually make this happen we should propose a design since there are a few ways we could express filtering + overlays with Rego.

This is a POC of a Rego interceptor. It uses a filter query and an overlay query which provides the same functionality as this example CEL interceptor.

Preview of the rego syntax:

  triggers:
    - name: rego-trig-with-matches
      interceptors:
        - github:
            secretRef:
              secretName: webhook-secret
              secretKey: secret
        - rego:
            source: |
              package main
              default filter = false
              filter {
                input.header[k][i] == "pull_request"
                lower(k) == "x-github-event"
              }
              
              default overlay = {}
              overlay = {
                "extensions": {
                   "truncated_sha": substring(input.body.pull_request.head.sha, 0, 7),
                }
              }
      bindings:
      - name: rego-binding
      template:
        name: rego-trigger-template

This yaml is an example that uses the pullrequest task to comment on a PR when it is opened.

@dibyom
Copy link
Member

dibyom commented Mar 18, 2020

/kind feature

@tekton-robot
Copy link

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

/close

Send feedback to tektoncd/plumbing.

@tekton-robot
Copy link

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.

/lifecycle rotten

Send feedback to tektoncd/plumbing.

@tekton-robot tekton-robot added the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Aug 13, 2020
@tekton-robot
Copy link

@tekton-robot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

/close

Send feedback to tektoncd/plumbing.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@dibyom dibyom reopened this Aug 14, 2020
@afrittoli
Copy link
Member

/remove-lifecycle rotten

@tekton-robot tekton-robot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Aug 17, 2020
@afrittoli
Copy link
Member

I think this would be a really cool feature to have, since it would enable managing an reusing policies - which with CEL can only be copy/pasted across event listeners.

Once example would be filtering GitHub webhook events based on the user and type of events, which can be used to restrict access to github comment commands like "/test" to individuals in a certain group.

@tekton-robot
Copy link

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.

/lifecycle stale

Send feedback to tektoncd/plumbing.

@tekton-robot tekton-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 15, 2020
@tekton-robot
Copy link

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle rotten

Send feedback to tektoncd/plumbing.

@tekton-robot tekton-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Dec 15, 2020
@jmcshane
Copy link
Contributor

/remove-lifecycle rotten

@tekton-robot tekton-robot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Apr 11, 2021
@jmcshane
Copy link
Contributor

with the work done for the v0.13 release, I think this is a great time to invest in further interceptor patterns.

I'm going to take a look at the previous implementation by @bobcatfish and see how it can be adapted into the current deployment structure for the triggers-core-interceptors. With the plugin model, we could make this an optional alpha feature for some time and even allow it to be deployed separately within a triggers deployment.

@jmcshane
Copy link
Contributor

I took a slightly different approach now that we can allow for arbitrary JSON parameters in an interceptor expression. The base module is set at data.tekton and the rego filter will run data.tekton.filter.

You can then write additional queries based off that initial compiled module (which we then only have to compile once). Those queries will be evaluated and binding variables will locate each match to become a set of extension keys. I put some notes in the docs, but maybe it will be best to bring the solution to WG soon.

@tekton-robot
Copy link

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

@tekton-robot tekton-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jul 10, 2021
@tekton-robot
Copy link

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle rotten

Send feedback to tektoncd/plumbing.

@tekton-robot tekton-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Oct 15, 2021
@tekton-robot
Copy link

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen with a justification.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/close

Send feedback to tektoncd/plumbing.

@tekton-robot
Copy link

@tekton-robot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen with a justification.
Mark the issue as fresh with /remove-lifecycle rotten with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/close

Send feedback to tektoncd/plumbing.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/feature Categorizes issue or PR as related to a new feature. lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants